60 lines
2.6 KiB
Python
60 lines
2.6 KiB
Python
"""Static isolation and security checks for the HUX Wave C vanilla runtime."""
|
|
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).parents[2]
|
|
RUNTIME = ROOT / "dockerfiles/hermes-webui-hux/runtime"
|
|
SCRIPT = RUNTIME / "wave_c_multimodal_onboarding_release.js"
|
|
STYLE = RUNTIME / "wave_c_multimodal_onboarding_release.css"
|
|
|
|
|
|
def test_wave_c_runtime_is_isolated_dependency_free_and_small():
|
|
"""The compatibility lane stays inert and can be reviewed as a small pair."""
|
|
source = SCRIPT.read_text()
|
|
style = STYLE.read_text()
|
|
assert len(source.splitlines()) < 500
|
|
assert len(style.splitlines()) < 500
|
|
lowered = (source + style).lower()
|
|
for forbidden in ("react", "tsx", "lucide", "tailwind", "localstorage", "sessionstorage", "indexeddb"):
|
|
assert forbidden not in lowered
|
|
assert "innerHTML" not in source
|
|
assert "fetch(" not in source
|
|
assert "hux-wave-c" in style
|
|
assert "focus-visible" in style
|
|
assert "prefers-reduced-motion" in style
|
|
|
|
|
|
def test_wave_c_routes_are_capability_gated_and_currently_absent():
|
|
"""No incomplete card can make an unadvertised backend route callable."""
|
|
source = SCRIPT.read_text()
|
|
for card in ("HUX-07", "HUX-09", "HUX-12"):
|
|
assert card in source
|
|
assert "server route is not available" in source
|
|
assert "Nothing was enabled or changed" in source
|
|
assert "spec.routes.filter((route) => !card.routes.includes(route))" in source
|
|
assert "cache: 'no-store'" not in source # canonical client owns transport policy
|
|
assert "contract.createCanonicalClient" in source
|
|
|
|
|
|
def test_release_panel_cannot_conflate_pipeline_states_with_live():
|
|
"""Only complete live evidence produces a positive deployment claim."""
|
|
source = SCRIPT.read_text()
|
|
for evidence in ("image_digest", "harbor_digest", "pod_digest", "flux_revision", "health_check"):
|
|
assert evidence in source
|
|
assert "raw.state !== 'live_verified'" in source
|
|
assert "health.status !== 'pass'" in source
|
|
assert "Live release evidence could not be verified" in source
|
|
assert "queued" not in source
|
|
|
|
|
|
def test_onboarding_and_multimodal_are_exactly_bound_and_non_automatic():
|
|
"""Scoped identity and contextual triggers precede every optional surface."""
|
|
source = SCRIPT.read_text()
|
|
for token in ("sameIdentity", "project_id", "conversation_id", "sessionId", "normalizeTrigger"):
|
|
assert token in source
|
|
assert "Suggestions appear only after an exact app event" in source
|
|
assert "Capture and upload remain approval-gated" in source
|
|
assert "Idempotency-Key" in source
|
|
assert "clicked: true" in source and "'If-Match'" in source
|