aaronrene / overseer-kit public
test_track_o_security.py python
70 lines 2.4 KB
Raw
sha256:c07f2f34a0db9f43fe866f157d1935322008545ff8940c06c7c921eb219c55ab NXP-b DONE: independent BV-r2 pass + ISR (SD-17) Human minor ⚠ breaking 17 hours ago
1 """Security tests — Track O contract pack (§O0.8 security)."""
2
3 from __future__ import annotations
4
5 import socket
6 from pathlib import Path
7 from unittest import mock
8
9 from tools.track_o.validate import (
10 CONTRACT_REL,
11 KNOWTATION_REL,
12 MUSEHUB_OPTIONAL,
13 PACK_RELS,
14 SCOOLING_REL,
15 SECRET_BLOB_PATTERNS,
16 SILENT_REGIME_REJECTION,
17 validate_track_o_pack,
18 )
19
20 KIT_ROOT = Path(__file__).resolve().parents[2]
21
22
23 def test_no_secret_patterns_in_contract_pack() -> None:
24 for rel in PACK_RELS:
25 text = (KIT_ROOT / rel).read_text(encoding="utf-8")
26 for pattern in SECRET_BLOB_PATTERNS:
27 assert not pattern.search(text), f"{rel} matched {pattern.pattern}"
28
29
30 def test_no_network_calls_on_harness_path() -> None:
31 with mock.patch.object(socket.socket, "connect", side_effect=AssertionError("network")):
32 result = validate_track_o_pack(KIT_ROOT)
33 assert result.ok, result.errors
34
35
36 def test_path_escape_outside_repo_root_fails_closed(tmp_path: Path) -> None:
37 """A kit_root that cannot contain declared paths still fail-closes (missing files)."""
38 alien = tmp_path / "alien"
39 alien.mkdir()
40 result = validate_track_o_pack(alien)
41 assert not result.ok
42 assert any(e.startswith("missing_file:") for e in result.errors)
43 assert not (alien / CONTRACT_REL).exists()
44
45
46 def test_k7_musehub_optional_statement_present() -> None:
47 text = (KIT_ROOT / CONTRACT_REL).read_text(encoding="utf-8")
48 assert MUSEHUB_OPTIONAL in text
49
50
51 def test_silent_regime_edit_rejection_present() -> None:
52 text = (KIT_ROOT / CONTRACT_REL).read_text(encoding="utf-8")
53 assert SILENT_REGIME_REJECTION in text
54
55
56 def test_injected_secret_fails_closed(tmp_path: Path) -> None:
57 (tmp_path / "docs" / "consumers" / "scooling").mkdir(parents=True)
58 (tmp_path / "docs" / "consumers" / "knowtation").mkdir(parents=True)
59 contract = (KIT_ROOT / CONTRACT_REL).read_text(encoding="utf-8")
60 poisoned = contract + '\napi_key = "sk-abcdefghijklmnopqrstuvwxyz1234567890"\n'
61 (tmp_path / CONTRACT_REL).write_text(poisoned, encoding="utf-8")
62 (tmp_path / SCOOLING_REL).write_text(
63 (KIT_ROOT / SCOOLING_REL).read_text(encoding="utf-8"), encoding="utf-8"
64 )
65 (tmp_path / KNOWTATION_REL).write_text(
66 (KIT_ROOT / KNOWTATION_REL).read_text(encoding="utf-8"), encoding="utf-8"
67 )
68 result = validate_track_o_pack(tmp_path)
69 assert not result.ok
70 assert any(e.startswith("secret_leak:") for e in result.errors)
File History 1 commit
sha256:c07f2f34a0db9f43fe866f157d1935322008545ff8940c06c7c921eb219c55ab NXP-b DONE: independent BV-r2 pass + ISR (SD-17) Human minor ⚠ 17 hours ago