You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
test: prove operator CLI public-key execution and replay denial across killed process restart - #76
Adds real subprocess isolation using Python multiprocessing spawn, invoking the actual shards-kernel serve --config CLI parser in a fresh interpreter. The test issuer holds a freshly generated Ed25519 private key in the parent test interpreter; only public verification material enters the service config. The secret bearer is supplied via environment rather than committed source.
Assertion sequence
The CLI serves /health on fixed loopback, using validated operator config.
Unauthenticated /submit → HTTP 401.
Attempt to spoof a different agent despite correct bearer → HTTP 403.
Signed v2 permit from parent issuer → HTTP 200 receipt ALLOW, tool returns one-time.
Exported audit ledger has a verified root hash.
Forcefully terminate service process (no graceful flush hook).
Spawn a new interpreter with the same SQLite audit path and public config.
Recovered audit root equals pre-crash root; replay of the same signed permit returns DENY/REPLAY_DETECTED.
Requires Python 3.9–3.12 CI, all static/security checks, coverage and docs to pass.
Explicit limitations
The side effect is built-in echo, not a non-idempotent external action. This does not establish distributed nonce transactions, secure remote agent credentials, independent protected issuer deployment, wallet safety, signed configuration or multi-node recovery. All relevant P0 issues remain open.
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
⚠️Resolve issues before merging
Two test assertions currently weaken the evidence this PR provides. The process restart should use an unconditional kill to demonstrate recovery after abrupt termination, and the audit-root check should validate that the exported root is present and valid rather than only comparing two values. The coverage report is empty, so it does not independently establish production-path coverage.
Test suggestions
Start the actual CLI in a spawned process and wait for a healthy loopback HTTP service.
Reject an unauthenticated submit request.
Reject an authenticated request with a spoofed actor.
Accept a valid signed permit and execute the configured echo tool.
Preserve the audit root across forced termination and restart.
Reject reuse of the original signed permit as a replay after restart.
Verify that the service configuration contains only public issuer key material.
The reason will be displayed to describe this comment to others. Learn more.
🟡 MEDIUM RISK
Replace the normal terminate() path used by this test with an unconditional hard kill (for example, process.kill()), so the ledger is reopened after an actual abrupt process death rather than a potentially graceful shutdown.
TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.
The reason will be displayed to describe this comment to others. Learn more.
🟡 MEDIUM RISK
Suggestion: Assert that the exported root hash is present and valid before terminating the service, rather than relying solely on equality after restart.
TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Process-boundary acceptance proof for #69 / #63
Adds real subprocess isolation using Python multiprocessing spawn, invoking the actual
shards-kernel serve --configCLI parser in a fresh interpreter. The test issuer holds a freshly generated Ed25519 private key in the parent test interpreter; only public verification material enters the service config. The secret bearer is supplied via environment rather than committed source.Assertion sequence
/healthon fixed loopback, using validated operator config./submit→ HTTP 401.one-time.Requires Python 3.9–3.12 CI, all static/security checks, coverage and docs to pass.
Explicit limitations
The side effect is built-in
echo, not a non-idempotent external action. This does not establish distributed nonce transactions, secure remote agent credentials, independent protected issuer deployment, wallet safety, signed configuration or multi-node recovery. All relevant P0 issues remain open.