gabriel / musehub public
test patch dev
AI Agent gabriel · 125 days ago · May 7, 2026 · Diff

test: attestation Phase 1 — seven-tier TDD suite (all RED)

52 tests across 7 tiers covering claim-type registry, scope/scope_ref, commit-level attestations, expiry, DB integrity, performance, and security.

Tier 1 — unit: registry lookup, scope_ref parsing, scope-claim enforcement, canonical message shape, AttestationRequest Pydantic validation Tier 2 — integration: identity/repo/commit scope round-trips, expiry filtering, registry enforcement, deprecated type rejection, DB registry add/deprecate, idempotency Tier 3 — e2e: TestClient round-trips for create/list/revoke/types endpoint Tier 4 — stress: 50 concurrent identical issues → 1 row; 100 distinct Tier 5 — data integrity: unique PK constraint, revoke-not-delete, scope column defaults, verbatim claim storage Tier 6 — performance: 500-row subject query < 50ms, commit query < 20ms Tier 7 — security: cross-protocol replay, attester impersonation, tampered claim, revoker impersonation, expiry without revocation, key rotation backward compat, SQL metachar injection

Closes #28 Phase 1 test gate. Implementation: next.

sha256:d9c51d610099345c4e85c8bad76ae0914fdf933c193dab22695b5a4f533030e2 sha
sha256:80aa028938104200661e7ea777b77ebe59297dba34ea6f5d1115fbc90d4a2484 parent
+81 ~4 symbols
sha256:38ad4938524464b4b461f0e377b8e41a29cd314a03d4049e24171cacb86ad517 snapshot
+81
symbols added
~4
symbols modified
0
dead code introduced
Semantic Changes 85 symbols
~ tests/test_attestations_phase1.py .py 81 symbols added
+ TestAttestationAPIRoundTrip class class TestAttestationAPIRoundTrip L531–635
+ test_e2e_claim_types_endpoint method method test_e2e_claim_types_endpoint L604–610
+ test_e2e_commit_scope_not_in_profile_list method method test_e2e_commit_scope_not_in_profile_list L560–586
+ test_e2e_create_and_list_identity_scope method method test_e2e_create_and_list_identity_scope L533–558
+ test_e2e_revoke_removes_from_listing method method test_e2e_revoke_removes_from_listing L612–635
+ test_e2e_unknown_type_returns_400 method method test_e2e_unknown_type_returns_400 L588–602
+ TestAttestationRequestModel class class TestAttestationRequestModel L267–302
+ test_commit_scope_requires_scope_ref method method test_commit_scope_requires_scope_ref L281–290
+ test_expires_at_accepted method method test_expires_at_accepted L292–302
+ test_scope_default_is_identity method method test_scope_default_is_identity L269–279
+ TestCanonicalMessage class class TestCanonicalMessage L221–259
+ test_commit_scope_appends_scope_ref method method test_commit_scope_appends_scope_ref L237–249
+ test_deterministic method method test_deterministic L251–259
+ test_identity_scope_message_unchanged method method test_identity_scope_message_unchanged L223–235
+ TestClaimTypeRegistry class class TestClaimTypeRegistry L88–137
+ test_all_seed_types_present method method test_all_seed_types_present L112–123
+ test_deprecated_type_raises_on_issue method method test_deprecated_type_raises_on_issue L105–110
+ test_known_type_resolves method method test_known_type_resolves L91–97
+ test_unknown_type_raises method method test_unknown_type_raises L99–103
+ test_valid_scopes_per_type method method test_valid_scopes_per_type L125–137
+ TestScopeClaimEnforcement class class TestScopeClaimEnforcement L191–213
+ test_collab_on_commit_scope_passes method method test_collab_on_commit_scope_passes L205–208
+ test_deploy_approved_on_identity_scope_raises method method test_deploy_approved_on_identity_scope_raises L199–203
+ test_human_on_commit_scope_raises method method test_human_on_commit_scope_raises L193–197
+ test_stems_verified_on_identity_passes method method test_stems_verified_on_identity_passes L210–213
+ TestScopeRefParsing class class TestScopeRefParsing L145–183
+ test_commit_scope_ref_missing_at_raises method method test_commit_scope_ref_missing_at_raises L173–177
+ test_commit_scope_ref_parsed method method test_commit_scope_ref_parsed L164–171
+ test_identity_scope_ref_is_handle method method test_identity_scope_ref_is_handle L148–154
+ test_invalid_scope_raises method method test_invalid_scope_raises L179–183
+ test_repo_scope_ref_parsed method method test_repo_scope_ref_parsed L156–162
+ _make_keypair function function _make_keypair L41–44
+ _req function function _req L52–80
+ _sign function function _sign L47–49
+ _utc function function _utc L37–38
+ AsyncMock import import AsyncMock L21–21
+ AsyncSession import import AsyncSession L26–26
+ AttestationRequest import import AttestationRequest L29–29
+ AttestationResponse import import AttestationResponse L29–29
+ Ed25519PrivateKey import import Ed25519PrivateKey L24–24
+ MagicMock import import MagicMock L21–21
+ annotations import import annotations L15–15
+ asyncio import import asyncio L17–17
+ compute_attestation_id import import compute_attestation_id L28–28
+ create_profile import import create_profile L30–30
+ create_repo import import create_repo L30–30
+ datetime import import datetime L20–20
+ encode_pubkey import import encode_pubkey L25–25
+ encode_sig import import encode_sig L25–25
+ json import import json L18–18
+ pytest import import pytest L23–23
+ time import import time L19–19
+ timedelta import import timedelta L20–20
+ timezone import import timezone L20–20
+ test_d1_attestation_id_unique_constraint function async_function test_d1_attestation_id_unique_constraint L683–718
+ test_d2_revoked_at_set_not_deleted function async_function test_d2_revoked_at_set_not_deleted L723–741
+ test_d3_scope_columns_non_nullable_defaults function async_function test_d3_scope_columns_non_nullable_defaults L746–764
+ test_d4_claim_stored_verbatim function async_function test_d4_claim_stored_verbatim L769–785
+ test_i10_registry_seed_types_in_db function async_function test_i10_registry_seed_types_in_db L473–479
+ test_i11_add_new_claim_type function async_function test_i11_add_new_claim_type L484–499
+ test_i12_deprecated_type_rejected function async_function test_i12_deprecated_type_rejected L504–523
+ test_i1_issue_identity_scope function async_function test_i1_issue_identity_scope L311–327
+ test_i2_issue_commit_scope function async_function test_i2_issue_commit_scope L332–351
+ test_i3_commit_scope_excluded_from_identity_query function async_function test_i3_commit_scope_excluded_from_identity_query L356–370
+ test_i4_expired_attestation_excluded_by_default function async_function test_i4_expired_attestation_excluded_by_default L375–385
+ test_i5_expired_attestation_included_with_flag function async_function test_i5_expired_attestation_included_with_flag L390–399
+ test_i6_unknown_claim_type_rejected function async_function test_i6_unknown_claim_type_rejected L404–412
+ test_i7_wrong_scope_for_claim_type_rejected function async_function test_i7_wrong_scope_for_claim_type_rejected L417–428
+ test_i8_idempotent_issue function async_function test_i8_idempotent_issue L433–447
+ test_i9_repo_scope_stored_and_retrieved function async_function test_i9_repo_scope_stored_and_retrieved L452–464
+ test_p1_subject_query_under_50ms_with_500_rows function async_function test_p1_subject_query_under_50ms_with_500_rows L794–811
+ test_p2_commit_query_under_20ms function async_function test_p2_commit_query_under_20ms L816–835
+ test_s1_concurrent_identical_issue_is_idempotent function async_function test_s1_concurrent_identical_issue_is_idempotent L644–658
+ test_s2_many_distinct_attestations function async_function test_s2_many_distinct_attestations L663–674
+ test_sec1_cross_protocol_replay_rejected function async_function test_sec1_cross_protocol_replay_rejected L844–860
+ test_sec2_attester_impersonation_rejected function async_function test_sec2_attester_impersonation_rejected L865–882
+ test_sec3_tampered_claim_rejected function async_function test_sec3_tampered_claim_rejected L887–902
+ test_sec4_revoker_impersonation_rejected function async_function test_sec4_revoker_impersonation_rejected L907–916
+ test_sec5_expired_attestation_excluded_without_flag function async_function test_sec5_expired_attestation_excluded_without_flag L921–932
+ test_sec6_key_rotation_old_attestations_still_verifiable function async_function test_sec6_key_rotation_old_attestations_still_verifiable L937–950
+ test_sec7_sql_metachar_in_claim_stored_safely function async_function test_sec7_sql_metachar_in_claim_stored_safely L955–967
~ pyproject.toml .toml 4 symbols modified
~ tool
~ pytest
~ ini_options
~ markers
← Older Oldest on dev
All commits
Newer → Latest on dev

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:d9c51d610099345c4e85c8bad76ae0914fdf933c193dab22695b5a4f533030e2 --body "your comment"