Merge remote-tracking branch 'origin/main' into codex/sre-typed-automation-20260715

# Conflicts:
#	apps/api/tests/test_executor_trust_boundary_readback.py
This commit is contained in:
ogt
2026-07-15 16:09:12 +08:00
38 changed files with 5361 additions and 116 deletions

View File

@@ -349,8 +349,8 @@ def test_executor_trust_boundary_requires_broker_secret_isolation() -> None:
def test_executor_trust_boundary_requires_live_connection_headroom() -> None:
receipt = _verified_receipt()
receipt["worker_active_role_connection_count"] = "7"
receipt["worker_available_connection_headroom"] = "1"
receipt["worker_active_role_connection_count"] = "8"
receipt["worker_available_connection_headroom"] = "0"
readback = build_executor_trust_boundary_readback(
receipt,
@@ -382,6 +382,24 @@ def test_executor_trust_boundary_requires_api_null_pool_concurrency_cap() -> Non
)
def test_executor_trust_boundary_does_not_double_count_used_budget() -> None:
receipt = _verified_receipt()
receipt["worker_active_role_connection_count"] = "3"
receipt["worker_available_connection_headroom"] = "5"
readback = build_executor_trust_boundary_readback(
receipt,
deployed_source_sha="abc123",
)
database_boundary = readback["database_identity_boundary"]
assert readback["full_workload_boundary_verified"] is True
assert database_boundary["connection_budget_verified"] is True
assert "worker_connection_budget_not_verified" not in (
database_boundary["active_blockers"]
)
def test_executor_trust_boundary_binds_budget_and_verifier_contract() -> None:
wrong_budget = _verified_receipt()
wrong_budget["worker_required_connection_budget"] = "4"