3bca7b7465
Re-enforcement prerequisites, code-side complete: the autonomy runtime now docks pending-approval cards above the composer (newest first, cap three, aria-live, allow-once / always / deny wired to the existing decide route with idempotency; polling gated to active turns and fail-tolerant), so parked tool calls are never silent. The default capability matrix no longer denies by default: network and web_search ask below autonomous (visible prompt) and nothing resolves to deny except explicit grants or private mode; SO-39 stays intact - deploy and external side effects always ask and external never auto-allows. rules.py at 100% line+branch; 744 hux-lane tests green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BvMSXH8VH2tMWXanb8SJdf
76 lines
3.2 KiB
Python
76 lines
3.2 KiB
Python
"""Static and executable gates for vanilla HUX-05/HUX-10 renderers."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
from hux_node_gate import run_node_coverage
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
RUNTIME = ROOT / "dockerfiles" / "hermes-webui-hux" / "runtime"
|
|
|
|
|
|
|
|
def test_runtime_autonomy_privacy_node_suite_and_coverage():
|
|
run_node_coverage(
|
|
[
|
|
"dockerfiles/hermes-webui-hux/runtime/autonomy-privacy.js",
|
|
],
|
|
[
|
|
"testing/tests/test_hermes_hux_runtime_autonomy_privacy_node.js",
|
|
"testing/tests/test_hermes_hux_runtime_stop_node.js",
|
|
],
|
|
{"branches": 95, "functions": 95, "lines": 95},
|
|
strip_types=False,
|
|
)
|
|
|
|
|
|
def test_runtime_pair_is_scoped_dependency_free_and_inert():
|
|
js = (RUNTIME / "autonomy-privacy.js").read_text(encoding="utf-8")
|
|
css = (RUNTIME / "autonomy-privacy.css").read_text(encoding="utf-8")
|
|
assert "require('./wave_a_contract.js')" in js
|
|
assert "require('../shell.js')" in js
|
|
assert "HermesHuxAutonomyPrivacy" in js
|
|
assert "autonomyExtension" in js and "privacyExtension" in js
|
|
assert "hux.autonomy" in js and "hux.privacy" in js
|
|
assert all(token not in js for token in ("React", "lucide", "tailwind", "localStorage", "sessionStorage", "indexedDB"))
|
|
assert "dangerouslySetInnerHTML" not in js and ".innerHTML" not in js
|
|
assert 'credentials: \'same-origin\'' in js and "cache: 'no-store'" in js
|
|
assert "'If-Match'" in js and "'Idempotency-Key'" in js
|
|
assert "Stop receipt" in js and "GENERIC_NOTICE" in js
|
|
assert "hux-runtime-inline-dock" in js and "hux-runtime-inline-dock" in css
|
|
assert "'aria-live': 'polite'" in js and "Approvals needed" in js
|
|
assert ".hux-runtime" in css and "body" not in css and ":root" not in css
|
|
assert "focus-visible" in css and "prefers-reduced-motion" in css
|
|
assert len(js.splitlines()) < 500 and len(css.splitlines()) < 500
|
|
dockerfile = (ROOT / "dockerfiles/Dockerfile.hermes-webui").read_text(encoding="utf-8")
|
|
assert "COPY dockerfiles/hermes-webui-hux/runtime/autonomy-privacy.js" in dockerfile
|
|
bootstrap = (ROOT / "dockerfiles/hermes-webui-hux/bootstrap.js").read_text(encoding="utf-8")
|
|
assert "HermesHuxAutonomyPrivacy" in bootstrap
|
|
assert "createAutonomyPrivacyRuntime" in bootstrap
|
|
assert "governance: ['HUX-05', 'HUX-10']" in bootstrap
|
|
assert "tenantSlot" in js and "userRef" in js and "trust" in js
|
|
assert "tenantRef" not in js
|
|
assert "S.session" in bootstrap and "value.hux_context" in bootstrap
|
|
|
|
|
|
def test_runtime_uses_canonical_backend_routes_and_explicit_safety_language():
|
|
js = (RUNTIME / "autonomy-privacy.js").read_text(encoding="utf-8")
|
|
for route in (
|
|
"/policy?scope=conversation&scope_id=",
|
|
"/approvals?status=pending",
|
|
"/approvals/",
|
|
"/runs/",
|
|
"/privacy/policy",
|
|
"/privacy/notices",
|
|
"/conversations/",
|
|
"/privacy/audit",
|
|
):
|
|
assert route in js
|
|
assert "Pending approvals" in js
|
|
assert "Allow once" in js and "Always allow" in js and "Deny" in js
|
|
assert "Approval needed" in js and "more waiting in the workspace drawer" in js
|
|
assert "prior sensitive details are not repeated" in js
|
|
assert "process_registry_empty: false" in js
|