owner
6ffd7fe19c
Apply the approved Implementation Baseline 1.1 architecture revisions onto the current mainline, verified faithful to the delivered change bundle: - Add aios_baseline: signed owner-delegation-grant.v1 / operational-epoch.v1 / task-principal.v1 auth chain, runtime contract + deployment-truth evaluator, declarative operation registry (effect-class + fail-closed dispatch), lineage ledger, release/recipe/saga ledger, bounded optimization controller, authenticated HTTP transport, resident worker loop and systemd host probe. - Extend existing Job authority (aios_gitops_job_controller/executor) with durable intent/receipt/reconcile and fail-closed admission; harden task_plane/store heartbeat CAS and terminal-state fencing; make reconciliation_controller fail-closed on incomplete/drift evidence. - Add isolated-validation profile templates (deploy/baseline-v1.1, systemd .example), source change/rollback tooling (tools/baseline_v1_1), the AT-01..AT-23 acceptance matrix, M0-M5 runbook, installation/rollback docs and the baseline_v1_1 test suite. - Keep legacy write authorities untouched; isolated-validation profile only. Staged blobs verified byte-identical to the delivered source-changes bundle. Cross-platform baseline tests pass; systemd/fcntl-dependent paths require the declared Linux x86_64 + CPython 3.12 + systemd runtime (site-bound).
44 lines
2.0 KiB
Python
44 lines
2.0 KiB
Python
import json
|
|
from pathlib import Path
|
|
import pytest
|
|
from aios_baseline.cli import initialize_validation, load_configuration, build_service
|
|
|
|
|
|
def test_generated_validation_configuration_is_usable_and_not_production(tmp_path):
|
|
root=tmp_path/'validation'
|
|
initialize_validation(root,unit='sample.service')
|
|
config,tokens=load_configuration(root/'server.json')
|
|
assert config['profile']=='isolated-validation'
|
|
assert len(tokens)==2
|
|
assert not (root/'state').exists() # preflight is read only
|
|
service=build_service(config)
|
|
assert service.jobs.store is not None
|
|
assert (root/'owner-private.pem').stat().st_mode & 0o077 == 0
|
|
raw=json.loads((root/'server.json').read_text())
|
|
raw['profile']='production'
|
|
(root/'server.json').write_text(json.dumps(raw))
|
|
with pytest.raises(ValueError,match='PROFILE'): load_configuration(root/'server.json')
|
|
|
|
|
|
def test_config_cannot_register_duplicate_tokens_or_expand_secret_variables(tmp_path,monkeypatch):
|
|
root=tmp_path/'validation'
|
|
initialize_validation(root,unit='sample.service')
|
|
raw=json.loads((root/'server.json').read_text())
|
|
raw['identities'][1]['token_file']=raw['identities'][0]['token_file']
|
|
(root/'server.json').write_text(json.dumps(raw))
|
|
with pytest.raises(ValueError,match='TOKEN'): load_configuration(root/'server.json')
|
|
raw['identities'][1]['token_file']='$HOME/token'
|
|
(root/'server.json').write_text(json.dumps(raw))
|
|
with pytest.raises(ValueError,match='PATH'): load_configuration(root/'server.json')
|
|
|
|
|
|
def test_config_rejects_symlink_public_config_and_untrusted_state_marker(tmp_path):
|
|
root=tmp_path/'validation'
|
|
initialize_validation(root,unit='sample.service')
|
|
alias=tmp_path/'alias.json';alias.symlink_to(root/'server.json')
|
|
with pytest.raises(OSError): load_configuration(alias)
|
|
config,_=load_configuration(root/'server.json')
|
|
state=root/'state';state.mkdir(mode=0o700)
|
|
(state/'ISOLATED_VALIDATION_AUTHORITY').write_text('different-authority\n')
|
|
with pytest.raises(ValueError,match='MARKER'): build_service(config)
|