ops(observatory): install exact recorded-progress agent layers

2026-09-03 11:22:03 +03:00
parent bee8552003
commit 54c8d82884
3 changed files with 485 additions and 0 deletions
@@ -0,0 +1,62 @@
+"""Control-agent layer admission; no Docker or model execution."""
+
+import importlib.util
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+SCRIPTS = Path(__file__).parents[1] / "experiments/perception/worker/observatory_portable"
+
+
+@pytest.fixture
+def installer(monkeypatch):
+    monkeypatch.syspath_prepend(str(SCRIPTS))
+    spec = importlib.util.spec_from_file_location(
+        "recorded_progress_installer", SCRIPTS / "install_recorded_progress.py"
+    )
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    monkeypatch.setitem(sys.modules, spec.name, module)
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_pack_is_exact_bounded_code_only_and_hash_gated(installer, tmp_path):
+    output = tmp_path / "payload"
+    installer.pack(Path(__file__).parents[1], output)
+    assert set(installer.payload_files(output)) == set(installer.BEFORE)
+    with pytest.raises(FileExistsError):
+        installer.pack(Path(__file__).parents[1], output)
+    file = output / "worker_agent.py"
+    file.write_bytes(file.read_bytes() + b"\n# modified\n")
+    with pytest.raises(ValueError, match="hash mismatch"):
+        installer.payload_files(output)
+
+
+def test_manifest_cannot_add_unreviewed_paths(installer, tmp_path):
+    output = tmp_path / "payload"
+    installer.pack(Path(__file__).parents[1], output)
+    manifest = json.loads((output / "payload.json").read_text())
+    manifest["files"]["../../outside.py"] = "0" * 64
+    (output / "payload.json").write_text(json.dumps(manifest))
+    with pytest.raises(ValueError, match="file set changed"):
+        installer.payload_files(output)
+
+
+def test_cutover_rechecks_exact_container_and_declaration(installer):
+    name = next(iter(installer.TARGETS))
+    row = {
+        "Id": "a" * 64,
+        "Name": "/" + name,
+        "Image": "sha256:" + installer.TARGETS[name],
+        "State": {"Running": True},
+        "HostConfig": {"ReadonlyRootfs": True, "NetworkMode": "bridge"},
+        "Config": {"Labels": {"com.nodedc.authority": "observation-only"}, "Env": []},
+    }
+    target = {"name": name, "id": row["Id"], "create_sha256": installer.create_hash(row)}
+    installer.validate_fence(target, row)
+    row["HostConfig"]["Memory"] = 1024
+    with pytest.raises(ValueError, match="changed since plan"):
+        installer.validate_fence(target, row)