107 lines
3.5 KiB
Python
107 lines
3.5 KiB
Python
from __future__ import annotations
|
|
|
|
from datetime import datetime, timezone
|
|
|
|
from idea187_autopoiesis_verifiable_service import (
|
|
GenomeSigner,
|
|
PolicySandbox,
|
|
PolicyTemplate,
|
|
ProvenanceLedger,
|
|
ReplicatorPlanner,
|
|
ResourceEnvelope,
|
|
SafetyInvariants,
|
|
ServiceGenome,
|
|
TestContract,
|
|
)
|
|
|
|
|
|
def build_genome() -> ServiceGenome:
|
|
expected = __import__("hashlib").sha256("7:boot".encode("utf-8")).hexdigest()
|
|
return ServiceGenome(
|
|
name="http-service",
|
|
version="1.0.0",
|
|
image_ref="ghcr.io/example/http-service:1.0.0",
|
|
capabilities={"network": ["https://internal.example"]},
|
|
resource_envelope=ResourceEnvelope(
|
|
cpu_millicores=250,
|
|
memory_mib=256,
|
|
bandwidth_mbps=20,
|
|
cost_usd_per_hour=0.05,
|
|
max_replicas=3,
|
|
),
|
|
safety_invariants=SafetyInvariants(max_exposure=10, read_only_scopes=["/var/lib/cache"], denied_endpoints=["https://example.com"]),
|
|
mutation_operators=[{"name": "safe-fork", "kind": "fork"}],
|
|
test_contracts=[TestContract(name="startup", seed=7, input_fingerprint="boot", expected_output_hash=expected)],
|
|
)
|
|
|
|
|
|
def test_genome_sign_and_verify() -> None:
|
|
genome = build_genome()
|
|
signer = GenomeSigner.generate()
|
|
artifact = signer.sign(genome)
|
|
|
|
assert artifact.genome_hash == genome.content_hash()
|
|
assert GenomeSigner.verify(artifact) is True
|
|
|
|
|
|
def test_policy_sandbox_approves_safe_genome() -> None:
|
|
genome = build_genome()
|
|
policy = PolicyTemplate(
|
|
name="default-edge",
|
|
max_cpu_millicores=500,
|
|
max_memory_mib=512,
|
|
max_bandwidth_mbps=100,
|
|
max_cost_usd_per_hour=1.0,
|
|
allow_network_egress=True,
|
|
allowed_egress_endpoints=["https://internal.example"],
|
|
allowed_mutation_operators=["safe-fork"],
|
|
)
|
|
attestation = PolicySandbox().evaluate(genome, policy)
|
|
|
|
assert attestation.approved is True
|
|
assert attestation.reasons == []
|
|
assert all(result.passed for result in attestation.smoke_tests)
|
|
|
|
|
|
def test_ledger_merkle_root_and_replay_trace_are_deterministic() -> None:
|
|
genome = build_genome()
|
|
signer = GenomeSigner.generate()
|
|
artifact = signer.sign(genome)
|
|
policy = PolicyTemplate(
|
|
name="default-edge",
|
|
max_cpu_millicores=500,
|
|
max_memory_mib=512,
|
|
max_bandwidth_mbps=100,
|
|
max_cost_usd_per_hour=1.0,
|
|
allow_network_egress=True,
|
|
allowed_egress_endpoints=["https://internal.example"],
|
|
allowed_mutation_operators=["safe-fork"],
|
|
)
|
|
attestation = PolicySandbox().evaluate(genome, policy)
|
|
plan = ReplicatorPlanner().plan(genome, attestation)
|
|
|
|
ledger = ProvenanceLedger()
|
|
first = ledger.append(
|
|
actor_did="did:key:z6Mkh1",
|
|
action="replicate",
|
|
genome_hash=artifact.genome_hash,
|
|
attestation_hash=attestation.digest(),
|
|
trace_hash=plan.trace.digest(),
|
|
resource_snapshot=genome.resource_envelope.model_dump(mode="json"),
|
|
timestamp=datetime(2024, 1, 1, tzinfo=timezone.utc),
|
|
)
|
|
second = ledger.append(
|
|
actor_did="did:key:z6Mkh2",
|
|
action="promote",
|
|
genome_hash=artifact.genome_hash,
|
|
attestation_hash=attestation.digest(),
|
|
trace_hash=plan.trace.digest(),
|
|
resource_snapshot=genome.resource_envelope.model_dump(mode="json"),
|
|
timestamp=datetime(2024, 1, 1, 0, 1, tzinfo=timezone.utc),
|
|
)
|
|
|
|
assert first.entry_hash != second.entry_hash
|
|
assert ledger.merkle_root()
|
|
assert plan.approved is True
|
|
assert plan.trace.digest() == plan.trace.digest()
|