atlas-iac/testing/tests/test_hermes_hux_runtime_autonomy_privacy.py

"""Static and executable gates for vanilla HUX-05/HUX-10 renderers."""

from __future__ import annotations

from pathlib import Path

from hux_node_gate import run_node_coverage


ROOT = Path(__file__).resolve().parents[2]
RUNTIME = ROOT / "dockerfiles" / "hermes-webui-hux" / "runtime"



def test_runtime_autonomy_privacy_node_suite_and_coverage():
    run_node_coverage(
        [
            "dockerfiles/hermes-webui-hux/runtime/autonomy-privacy.js",
        ],
        [
            "testing/tests/test_hermes_hux_runtime_autonomy_privacy_node.js",
            "testing/tests/test_hermes_hux_runtime_stop_node.js",
        ],
        {"branches": 95, "functions": 95, "lines": 95},
        strip_types=False,
    )


def test_runtime_pair_is_scoped_dependency_free_and_inert():
    js = (RUNTIME / "autonomy-privacy.js").read_text(encoding="utf-8")
    css = (RUNTIME / "autonomy-privacy.css").read_text(encoding="utf-8")
    assert "require('./wave_a_contract.js')" in js
    assert "require('../shell.js')" in js
    assert "HermesHuxAutonomyPrivacy" in js
    assert "autonomyExtension" in js and "privacyExtension" in js
    assert "hux.autonomy" in js and "hux.privacy" in js
    assert all(token not in js for token in ("React", "lucide", "tailwind", "localStorage", "sessionStorage", "indexedDB"))
    assert "dangerouslySetInnerHTML" not in js and ".innerHTML" not in js
    assert 'credentials: \'same-origin\'' in js and "cache: 'no-store'" in js
    assert "'If-Match'" in js and "'Idempotency-Key'" in js
    assert "Stop receipt" in js and "GENERIC_NOTICE" in js
    assert "hux-runtime-inline-dock" in js and "hux-runtime-inline-dock" in css
    assert "'aria-live': 'polite'" in js and "Approvals needed" in js
    assert ".hux-runtime" in css and "body" not in css and ":root" not in css
    assert "focus-visible" in css and "prefers-reduced-motion" in css
    assert len(js.splitlines()) < 500 and len(css.splitlines()) < 500
    dockerfile = (ROOT / "dockerfiles/Dockerfile.hermes-webui").read_text(encoding="utf-8")
    assert "COPY dockerfiles/hermes-webui-hux/runtime/autonomy-privacy.js" in dockerfile
    bootstrap = (ROOT / "dockerfiles/hermes-webui-hux/bootstrap.js").read_text(encoding="utf-8")
    assert "HermesHuxAutonomyPrivacy" in bootstrap
    assert "createAutonomyPrivacyRuntime" in bootstrap
    assert "governance: ['HUX-05', 'HUX-10']" in bootstrap
    assert "tenantSlot" in js and "userRef" in js and "trust" in js
    assert "tenantRef" not in js
    assert "S.session" in bootstrap and "value.hux_context" in bootstrap


def test_runtime_uses_canonical_backend_routes_and_explicit_safety_language():
    js = (RUNTIME / "autonomy-privacy.js").read_text(encoding="utf-8")
    for route in (
        "/policy?scope=conversation&scope_id=",
        "/approvals?status=pending",
        "/approvals/",
        "/runs/",
        "/privacy/policy",
        "/privacy/notices",
        "/conversations/",
        "/privacy/audit",
    ):
        assert route in js
    assert "Pending approvals" in js
    assert "Allow once" in js and "Always allow" in js and "Deny" in js
    assert "Approval needed" in js and "more waiting in the workspace drawer" in js
    assert "prior sensitive details are not repeated" in js
    assert "process_registry_empty: false" in js