aaronrene / overseer-kit public
test_governance_gates_security.py python
39 lines 1.3 KB
Raw
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 1 day ago
1 """Security tests for governance gate scan (path safety, no shell)."""
2
3 from __future__ import annotations
4
5 from pathlib import Path
6
7 from adapters.config import ConfigError, load_config
8 from tests.support import FIXTURES
9
10
11 def test_governance_gates_surfaces_reject_unknown_entries(tmp_path: Path) -> None:
12 base = (FIXTURES / "config-governance-gates.yaml").read_text(encoding="utf-8")
13 bad = base.replace(
14 " - handover-paste",
15 " - handover-paste\n - exec-malicious",
16 )
17 path = tmp_path / "bad.yaml"
18 path.write_text(bad, encoding="utf-8")
19 try:
20 load_config(path)
21 raised = False
22 except ConfigError:
23 raised = True
24 assert raised
25
26
27 def test_scan_does_not_follow_path_escape_contract(tmp_path: Path) -> None:
28 from tools.governance_gates import scan_governance_gates
29
30 config = load_config(FIXTURES / "config-governance-gates.yaml")
31 docs = tmp_path / "docs"
32 docs.mkdir(parents=True)
33 (docs / "ROADMAP.md").write_text(
34 "| **Escape** | Thinking | **WIP** | `../../../etc/passwd` |\n",
35 encoding="utf-8",
36 )
37 (docs / "OVERSEER-HANDOVER.md").write_text("| **ID** | **Escape** |\n", encoding="utf-8")
38 result = scan_governance_gates(config, tmp_path)
39 assert all("passwd" not in (gate.artifact or "") for gate in result.pending)
File History 2 commits
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 1 day ago
sha256:4671b7f787ddbe63ced31c895b688c77ab495653b65a730b423329f26b3c1439 feat: K1-P1 complete — agent provenance, build-verification… Sonnet 4.6 patch 53 days ago