3717fc8167
Env-only layer exporting CP_WRITE_TOKEN_FILE=/run/agent/cp-write-token/token. The per-step wfcw_ token is delivered by the dispatcher into the script container only (AU-55b), so the layer has no secrets_required, init script or files. Not referenced by any composite yet; safe to merge at any time. Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF
38 lines
1.4 KiB
Python
38 lines
1.4 KiB
Python
"""cp-write-token/v1 context: env-only layer (WF-COMP-31c, AU-55b).
|
|
|
|
The per-step wfcw_ token is delivered by the dispatcher into the script
|
|
container only (Secret projection on K8s, create -> put_archive -> start on
|
|
Docker). The layer must therefore set the env contract and nothing else: no
|
|
ESO secret mount, no init script, no context files.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
_ROOT = Path(__file__).resolve().parents[2] / "harnesses"
|
|
|
|
|
|
def _load(kind_dir: str, name: str) -> dict:
|
|
return yaml.safe_load((_ROOT / kind_dir / name / "v1" / "harness.yaml").read_text())
|
|
|
|
|
|
def test_cp_write_token_layer_sets_env_contract():
|
|
doc = _load("contexts", "cp-write-token")
|
|
assert doc["kind"] == "context"
|
|
assert doc["name"] == "cp-write-token"
|
|
assert doc["version"] == 1
|
|
assert doc["env"] == {"CP_WRITE_TOKEN_FILE": "/run/agent/cp-write-token/token"}
|
|
|
|
|
|
def test_cp_write_token_layer_is_env_only():
|
|
doc = _load("contexts", "cp-write-token")
|
|
assert not doc.get("secrets_required"), "token is not an ESO mount (AU-55b)"
|
|
assert not doc.get("scripts"), "no init script: the backend delivers the file"
|
|
assert not doc.get("context_files")
|
|
assert not doc.get("write_targets")
|
|
assert doc.get("requires") == []
|
|
assert doc.get("provides") == []
|
|
assert not (_ROOT / "contexts" / "cp-write-token" / "v1" / "init.sh").exists()
|