wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(mcp): run governed version lifecycle receipts

Browse Source
This commit is contained in:
ogt
2026-07-15 02:16:48 +08:00
parent b49a1ec164
commit aed4b044d4
13 changed files with 1831 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

78
apps/api/tests/test_mcp_control_plane_api.py
View File

@@ -34,17 +34,24 @@ def test_catalog_contains_exact_12_products_and_explicit_missing_rows() -> None:
assert catalog["source_policy"]["github_allowed"] is False
assert catalog["security_policy"]["external_rag_auto_write_allowed"] is False
capabilities = {
row["capability_id"]: row for row in catalog["capabilities"]
}
capabilities = {row["capability_id"]: row for row in catalog["capabilities"]}
assert capabilities["rejected.github"]["decision"] == "rejected"
assert capabilities["quarantine.agent-bounty-mcp"]["decision"] == "quarantine"
assert capabilities["external.smithery-site-audit-shadow"]["decision"] == "evaluation_shadow_candidate"
assert capabilities["external.smithery-site-audit-shadow"]["deployment_allowed"] is False
assert capabilities["rejected.smithery-technical-analysis"]["decision"] == "rejected"
assert "tool_output_contains_cross_tool_prompt_injection" in capabilities[
"quarantine.agent-bounty-mcp"
]["blockers"]
assert (
capabilities["external.smithery-site-audit-shadow"]["decision"]
== "evaluation_shadow_candidate"
)
assert (
capabilities["external.smithery-site-audit-shadow"]["deployment_allowed"]
is False
)
assert (
capabilities["rejected.smithery-technical-analysis"]["decision"] == "rejected"
)
assert (
"tool_output_contains_cross_tool_prompt_injection"
in capabilities["quarantine.agent-bounty-mcp"]["blockers"]
)
assert not any(
row["deployment_allowed"]
for row in catalog["capabilities"]
@@ -73,7 +80,10 @@ def test_overview_joins_committed_product_matrix_without_runtime_claims() -> Non
products = {row["product_id"]: row for row in payload["products"]}
assert products["ewoooc"]["canonical_repo"] == "wooo/ewoooc"
assert products["momo-pro-system"]["canonical_repo"] == "wooo/momo-pro-system"
assert products["agent-bounty-protocol"]["inventory_state"] == "source_detected_quarantined"
assert (
products["agent-bounty-protocol"]["inventory_state"]
== "source_detected_quarantined"
)
def test_catalog_rejects_external_deployment_without_immutable_receipts(
@@ -102,15 +112,53 @@ def test_overview_endpoint_returns_real_committed_catalog_without_runtime() -> N
app.include_router(router, prefix="/api/v1")
client = TestClient(app)
response = client.get(
"/api/v1/mcp-control-plane/overview?include_runtime=false"
)
response = client.get("/api/v1/mcp-control-plane/overview?include_runtime=false")
assert response.status_code == 200
data = response.json()
assert data["summary"]["product_count"] == 12
assert data["runtime"]["status"] == "not_requested"
assert data["operation_boundaries"]["github_allowed"] is False
assert data["operation_boundaries"]["public_response_redacted_aggregate_only"] is True
assert (
data["operation_boundaries"]["public_response_redacted_aggregate_only"] is True
)
assert data["operation_boundaries"]["mutation_endpoint_exposed"] is False
assert data["operation_boundaries"]["operator_auth_required_for_future_mutation"] is True
assert (
data["operation_boundaries"]["operator_auth_required_for_future_mutation"]
is True
)
def test_overview_promotes_durable_lifecycle_receipt_not_static_policy() -> None:
catalog = load_mcp_control_plane_catalog(_OPERATIONS_DIR)
matrix = load_latest_product_governance_matrix_readback(_OPERATIONS_DIR)
runtime = {
"status": "ready",
"provider_registry": {"provider_count": 9, "tool_count": 39},
"gateway_audit_24h": {"call_count": 1},
"rag": {"total_chunks": 1},
"version_lifecycle": {
"status": "ready",
"latest_run": {
"run_id": "11111111-1111-1111-1111-111111111111",
"status": "completed_no_write_policy_blocked",
"fresh": True,
},
"blockers": ["external_candidates_not_promotion_ready"],
},
}
payload = build_mcp_control_plane_overview(
catalog=catalog,
product_matrix=matrix,
runtime=runtime,
)
assert payload["version_lifecycle"]["runtime_state"] == "running_fail_closed"
assert payload["version_lifecycle"]["runtime"]["status"] == "ready"
assert "external_candidates_not_promotion_ready" in payload["active_blockers"]
assert (
payload["operation_boundaries"]["normalized_version_receipt_write_allowed"]
is True
)
assert payload["operation_boundaries"]["production_upgrade_allowed"] is False