d208a89d9d
evaluate_names_absent returned PASS when its step exited 0 with no output, so five mandatory checks - the ones asserting that provider API keys, forge credentials, a cluster-admin binding, and shared coordinator state are absent - could report a pass on no evidence and turn a NO_GO into a GO. Both name rules now resolve their step through one guard in _line_step, so zero observations are NOT_RUN. Regressions pin all five real catalog specs plus both reachable silence paths: a POSIX pipeline whose status comes from its last stage, and a drifted kubectl -o jsonpath. The pool claim projection emits one <volume>=<claim> line per template volume so a volume without a PVC still counts as an observation rather than reading as drift. Also closes the review's reachable hardening and evidence defects: - pin Gitea paths to atlas/titan-iac on an exact segment boundary and reject relative segments, including percent-encoded ones - forbid impersonation structurally in every mode and vantage; the inner command of kubectl exec is re-checked rather than exempted, and validate_catalog no longer guards only the operator vantage - drop flux and helm from the binary allowlist; they had no pinned release digest, so no allowlisted binary can now be admitted that the executor would refuse to attest - remove the inert --concurrency and --expect-telegram-sessions flags and the dead concurrency bound; Telegram continuity stays mandatory - read the ephemeral pull index page by page, treat the create response as an authoritative source for the pull number, close every number either source names, and surface residue_ref plus exact manual_cleanup commands when creation is uncertain - keep executable_path and executable_sha256 on unrecorded bulk-evidence steps so withholding bytes never withholds binary attestation - revert the repo-wide hygiene legacy-exception mechanism; the contract change here is purely additive and the four pre-existing over-cap files are left to the canonical contract change in PR #14/#15 - correct the runbook ruff format scope so the documented command passes Split hermes_handoff_arming.py out of hermes_handoff_ephemeral.py to keep both modules under the 500-line cap. All 16 handoff modules hold at least 95% line and branch coverage; the mutation gate is 13/13. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
259 lines
8.9 KiB
JSON
259 lines
8.9 KiB
JSON
{
|
|
"required_docs": [
|
|
{
|
|
"path": "README.md",
|
|
"description": "Top-level repository handbook."
|
|
},
|
|
{
|
|
"path": "Jenkinsfile",
|
|
"description": "Top-level Jenkins mirror for multibranch discovery."
|
|
},
|
|
{
|
|
"path": "ci/Jenkinsfile.titan-iac",
|
|
"description": "Canonical titan-iac Jenkins pipeline definition."
|
|
}
|
|
],
|
|
"managed_modules": [
|
|
"scripts/ops/hermes_handoff_acceptance.py",
|
|
"scripts/ops/hermes_handoff_arming.py",
|
|
"scripts/ops/hermes_handoff_catalog.py",
|
|
"scripts/ops/hermes_handoff_checks_access.py",
|
|
"scripts/ops/hermes_handoff_checks_delivery.py",
|
|
"scripts/ops/hermes_handoff_checks_platform.py",
|
|
"scripts/ops/hermes_handoff_checks_workers.py",
|
|
"scripts/ops/hermes_handoff_ephemeral.py",
|
|
"scripts/ops/hermes_handoff_evaluators.py",
|
|
"scripts/ops/hermes_handoff_exec.py",
|
|
"scripts/ops/hermes_handoff_json_rules.py",
|
|
"scripts/ops/hermes_handoff_model.py",
|
|
"scripts/ops/hermes_handoff_policy.py",
|
|
"scripts/ops/hermes_handoff_redaction.py",
|
|
"scripts/ops/hermes_handoff_rules.py",
|
|
"scripts/ops/hermes_handoff_run.py",
|
|
"ci/scripts/publish_test_metrics.py",
|
|
"ci/scripts/publish_test_metrics_quality.py",
|
|
"ci/scripts/semgrep_report.py",
|
|
"ci/scripts/supply_chain_report.py",
|
|
"services/mailu/scripts/mailu_sync.py",
|
|
"services/mailu/scripts/mailu_sync_listener.py",
|
|
"testing/__init__.py",
|
|
"testing/quality_contract.py",
|
|
"testing/quality_docs.py",
|
|
"testing/quality_hygiene.py",
|
|
"testing/quality_coverage.py",
|
|
"testing/quality_handoff_mutation.py",
|
|
"testing/quality_gate.py",
|
|
"ci/tests/glue/test_ariadne_schedules.py",
|
|
"ci/tests/glue/test_glue_metrics.py",
|
|
"testing/tests/test_publish_test_metrics.py",
|
|
"testing/tests/test_supply_chain_report.py",
|
|
"testing/tests/test_semgrep_report.py",
|
|
"testing/tests/test_quality_contract.py",
|
|
"testing/tests/test_quality_gate.py"
|
|
],
|
|
"lint_paths": [
|
|
"scripts/ops/hermes_handoff_acceptance.py",
|
|
"scripts/ops/hermes_handoff_arming.py",
|
|
"scripts/ops/hermes_handoff_catalog.py",
|
|
"scripts/ops/hermes_handoff_checks_access.py",
|
|
"scripts/ops/hermes_handoff_checks_delivery.py",
|
|
"scripts/ops/hermes_handoff_checks_platform.py",
|
|
"scripts/ops/hermes_handoff_checks_workers.py",
|
|
"scripts/ops/hermes_handoff_ephemeral.py",
|
|
"scripts/ops/hermes_handoff_evaluators.py",
|
|
"scripts/ops/hermes_handoff_exec.py",
|
|
"scripts/ops/hermes_handoff_json_rules.py",
|
|
"scripts/ops/hermes_handoff_model.py",
|
|
"scripts/ops/hermes_handoff_policy.py",
|
|
"scripts/ops/hermes_handoff_redaction.py",
|
|
"scripts/ops/hermes_handoff_rules.py",
|
|
"scripts/ops/hermes_handoff_run.py",
|
|
"ci/scripts/publish_test_metrics.py",
|
|
"ci/scripts/publish_test_metrics_quality.py",
|
|
"ci/scripts/semgrep_report.py",
|
|
"ci/tests/glue",
|
|
"scripts/tests",
|
|
"services/comms/scripts/tests",
|
|
"services/mailu/scripts/mailu_sync.py",
|
|
"services/mailu/scripts/mailu_sync_listener.py",
|
|
"testing/tests",
|
|
"testing"
|
|
],
|
|
"pytest_suites": {
|
|
"unit": {
|
|
"description": "Fast unit and contract tests for repo automation.",
|
|
"paths": [
|
|
"scripts/tests",
|
|
"services/comms/scripts/tests",
|
|
"testing/tests"
|
|
],
|
|
"junit": "build/junit-unit.xml",
|
|
"coverage_sources": [
|
|
"ci/scripts",
|
|
"scripts/ops",
|
|
"scripts.render.dashboards_render_atlas",
|
|
"services/mailu/scripts",
|
|
"testing"
|
|
],
|
|
"coverage_xml": "build/coverage-unit.xml"
|
|
},
|
|
"glue": {
|
|
"description": "Cluster-live glue checks that validate CronJobs and exported metrics.",
|
|
"paths": [
|
|
"ci/tests/glue"
|
|
],
|
|
"junit": "build/junit-glue.xml"
|
|
}
|
|
},
|
|
"profiles": {
|
|
"local": [
|
|
"docs",
|
|
"smell",
|
|
"hygiene",
|
|
"unit",
|
|
"coverage"
|
|
],
|
|
"jenkins": [
|
|
"docs",
|
|
"smell",
|
|
"hygiene",
|
|
"unit",
|
|
"coverage",
|
|
"sonarqube",
|
|
"ironbank",
|
|
"glue"
|
|
]
|
|
},
|
|
"manual_scripts": [
|
|
{
|
|
"path": "scripts/manual-tests/test_atlas_user_cleanup.py",
|
|
"description": "Manual cleanup validation for Atlas user lifecycle automation."
|
|
},
|
|
{
|
|
"path": "scripts/manual-tests/test_user_cleanup.py",
|
|
"description": "Manual cleanup validation for shared user lifecycle automation."
|
|
},
|
|
{
|
|
"path": "scripts/manual-tests/test_vaultwarden_user_cleanup.py",
|
|
"description": "Manual cleanup validation for Vaultwarden user lifecycle automation."
|
|
},
|
|
{
|
|
"path": "services/bstein-dev-home/scripts/test_portal_onboarding_flow.py",
|
|
"description": "Portal onboarding end-to-end flow validation with mail delivery checks."
|
|
},
|
|
{
|
|
"path": "services/keycloak/scripts/tests/test_keycloak_execute_actions_email.py",
|
|
"description": "Standalone Keycloak SMTP execute-actions-email validation script."
|
|
},
|
|
{
|
|
"path": "services/keycloak/scripts/tests/test_portal_token_exchange.py",
|
|
"description": "Standalone Keycloak token-exchange validation script."
|
|
}
|
|
],
|
|
"hygiene": {
|
|
"max_lines": 500,
|
|
"line_limit_globs": [
|
|
"scripts/ops/hermes_handoff_*.py",
|
|
"testing/**/*.py",
|
|
"ci/scripts/*.py",
|
|
"ci/tests/**/*.py",
|
|
"scripts/tests/**/*.py",
|
|
"services/*/scripts/tests/**/*.py",
|
|
"services/mailu/scripts/mailu_sync.py",
|
|
"services/mailu/scripts/mailu_sync_listener.py"
|
|
],
|
|
"naming_rules": [
|
|
{
|
|
"glob": "testing/*.py",
|
|
"pattern": "^(?:__init__|quality_[a-z0-9_]+)\\.py$",
|
|
"description": "Top-level testing helpers use quality_* module names."
|
|
},
|
|
{
|
|
"glob": "testing/tests/*.py",
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
"description": "Top-level pytest files use test_*.py names."
|
|
},
|
|
{
|
|
"glob": "ci/tests/**/*.py",
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
"description": "CI pytest files use test_*.py names."
|
|
},
|
|
{
|
|
"glob": "scripts/tests/**/*.py",
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
"description": "Script pytest files use test_*.py names."
|
|
},
|
|
{
|
|
"glob": "scripts/test_*.py",
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
"description": "Standalone script tests use test_*.py names."
|
|
},
|
|
{
|
|
"glob": "services/*/scripts/tests/**/*.py",
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
"description": "Service pytest files use test_*.py names."
|
|
},
|
|
{
|
|
"glob": "services/*/scripts/test_*.py",
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
"description": "Standalone service test scripts use test_*.py names."
|
|
}
|
|
]
|
|
},
|
|
"coverage": {
|
|
"minimum_percent": 95.0,
|
|
"minimum_branch_percent": 95.0,
|
|
"branch_tracked_files": [
|
|
"scripts/ops/hermes_handoff_acceptance.py",
|
|
"scripts/ops/hermes_handoff_arming.py",
|
|
"scripts/ops/hermes_handoff_catalog.py",
|
|
"scripts/ops/hermes_handoff_checks_access.py",
|
|
"scripts/ops/hermes_handoff_checks_delivery.py",
|
|
"scripts/ops/hermes_handoff_checks_platform.py",
|
|
"scripts/ops/hermes_handoff_checks_workers.py",
|
|
"scripts/ops/hermes_handoff_ephemeral.py",
|
|
"scripts/ops/hermes_handoff_evaluators.py",
|
|
"scripts/ops/hermes_handoff_exec.py",
|
|
"scripts/ops/hermes_handoff_json_rules.py",
|
|
"scripts/ops/hermes_handoff_model.py",
|
|
"scripts/ops/hermes_handoff_policy.py",
|
|
"scripts/ops/hermes_handoff_redaction.py",
|
|
"scripts/ops/hermes_handoff_rules.py",
|
|
"scripts/ops/hermes_handoff_run.py",
|
|
"ci/scripts/semgrep_report.py",
|
|
"testing/quality_coverage.py",
|
|
"testing/quality_handoff_mutation.py"
|
|
],
|
|
"tracked_files": [
|
|
"scripts/ops/hermes_handoff_acceptance.py",
|
|
"scripts/ops/hermes_handoff_arming.py",
|
|
"scripts/ops/hermes_handoff_catalog.py",
|
|
"scripts/ops/hermes_handoff_checks_access.py",
|
|
"scripts/ops/hermes_handoff_checks_delivery.py",
|
|
"scripts/ops/hermes_handoff_checks_platform.py",
|
|
"scripts/ops/hermes_handoff_checks_workers.py",
|
|
"scripts/ops/hermes_handoff_ephemeral.py",
|
|
"scripts/ops/hermes_handoff_evaluators.py",
|
|
"scripts/ops/hermes_handoff_exec.py",
|
|
"scripts/ops/hermes_handoff_json_rules.py",
|
|
"scripts/ops/hermes_handoff_model.py",
|
|
"scripts/ops/hermes_handoff_policy.py",
|
|
"scripts/ops/hermes_handoff_redaction.py",
|
|
"scripts/ops/hermes_handoff_rules.py",
|
|
"scripts/ops/hermes_handoff_run.py",
|
|
"ci/scripts/publish_test_metrics.py",
|
|
"ci/scripts/publish_test_metrics_quality.py",
|
|
"ci/scripts/semgrep_report.py",
|
|
"ci/scripts/supply_chain_report.py",
|
|
"services/mailu/scripts/mailu_sync.py",
|
|
"services/mailu/scripts/mailu_sync_listener.py",
|
|
"testing/quality_contract.py",
|
|
"testing/quality_docs.py",
|
|
"testing/quality_hygiene.py",
|
|
"testing/quality_coverage.py",
|
|
"testing/quality_handoff_mutation.py",
|
|
"testing/quality_gate.py"
|
|
]
|
|
}
|
|
}
|