15f9133920
- Distinguish source synchronization from service, migration, worker, and database state changes. - Bound GCP claims to current VM, Cloud SQL inventory, logs, and serial evidence. - Keep the operating pack reliable with 14 skill validations and 809 passing tests. `.agents/skills/teleo-gcp-parity-ops/SKILL.md` `.agents/skills/teleo-infra-provenance/SKILL.md` `.agents/skills/teleo-kb-db-change-workflow/SKILL.md` `.agents/skills/teleo-leo-onboarding/SKILL.md` `.agents/skills/teleo-vps-runtime-ops/SKILL.md` `docs/reports/leo-working-state-20260709/current-truth-index.md` `docs/reports/leo-working-state-20260709/gcp-leo-runtime-observability-current.json` `docs/reports/leo-working-state-20260709/gcp-leo-runtime-observability-current.md` `docs/reports/leo-working-state-20260709/pr72-vps-auto-deploy-runtime-nonchange-current.json` `docs/reports/leo-working-state-20260709/pr72-vps-auto-deploy-runtime-nonchange-current.md` `docs/reports/leo-working-state-20260709/skill-pack-manifest.json` `docs/reports/leo-working-state-20260709/skill-pack-readme.md` `tests/test_repo_skill_pack.py`
111 lines
3.9 KiB
Python
111 lines
3.9 KiB
Python
from __future__ import annotations
|
|
|
|
import json
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
REPORT_DIR = ROOT / "docs" / "reports" / "leo-working-state-20260709"
|
|
MANIFEST = REPORT_DIR / "skill-pack-manifest.json"
|
|
|
|
|
|
def _skill(name: str) -> str:
|
|
return (ROOT / ".agents" / "skills" / name / "SKILL.md").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
|
|
|
|
def test_manifest_indexes_valid_repo_native_skills() -> None:
|
|
manifest = json.loads(MANIFEST.read_text(encoding="utf-8"))
|
|
|
|
assert manifest["status"] == "repo_native_validated"
|
|
assert manifest["repo_skill_root"] == ".agents/skills"
|
|
assert manifest["validation"] == "tests/test_repo_skill_pack.py"
|
|
assert "37/37" in manifest["claim_ceiling"]
|
|
assert "auto-synchronized" in manifest["claim_ceiling"]
|
|
assert "apply worker remained disabled/inactive" in manifest["claim_ceiling"]
|
|
|
|
for entry in manifest["skills"]:
|
|
path = ROOT / entry["path"]
|
|
text = path.read_text(encoding="utf-8")
|
|
assert path.is_file()
|
|
assert text.startswith("---\n")
|
|
assert f"name: {entry['name']}\n" in text.split("---\n", 2)[1]
|
|
assert "description:" in text.split("---\n", 2)[1]
|
|
|
|
for relative in manifest["reference_files"]:
|
|
assert (ROOT / relative).is_file(), relative
|
|
|
|
|
|
def test_db_change_skill_tracks_guarded_v2_runtime_proof() -> None:
|
|
text = _skill("teleo-kb-db-change-workflow")
|
|
squashed = " ".join(text.split())
|
|
|
|
for required in (
|
|
"`approve_claim` v2",
|
|
"kb_review",
|
|
"kb_apply",
|
|
"kb_gate_owner",
|
|
"NOINHERIT",
|
|
"37/37",
|
|
"exact table deltas",
|
|
"source hashes",
|
|
"trusted operator-only canonical writer",
|
|
"run_approve_claim_isolated_container_canary.sh",
|
|
):
|
|
assert required in text
|
|
|
|
assert "does not prove byte-for-byte live content" in squashed
|
|
assert "production permission migration" in squashed
|
|
assert "pr72-vps-auto-deploy-runtime-nonchange-current.md" in text
|
|
|
|
|
|
def test_gcp_skill_uses_current_cloud_sql_truth_and_exact_gate() -> None:
|
|
text = _skill("teleo-gcp-parity-ops")
|
|
squashed = " ".join(text.split())
|
|
observability = json.loads(
|
|
(REPORT_DIR / "gcp-leo-runtime-observability-current.json").read_text(
|
|
encoding="utf-8"
|
|
)
|
|
)
|
|
|
|
for required in (
|
|
"teleo-pgvector-standby",
|
|
"PostgreSQL `16.14`",
|
|
"teleo-staging-net",
|
|
"public IP disabled",
|
|
"Cloud SQL Studio",
|
|
"GCP Studio authenticated",
|
|
"begin transaction read only",
|
|
"DB contents",
|
|
"gcp-leo-runtime-observability-current.json",
|
|
"leoclean-cloudsql-memory-sync.service",
|
|
"zero seven-day entries",
|
|
):
|
|
assert required in text
|
|
|
|
assert "no enabled existing" in squashed
|
|
assert "IAM DB principal" in squashed
|
|
assert "Do not submit a raw password" in text
|
|
assert "AppleScript" in text
|
|
assert observability["delivery_context"]["gcp_deployment_status"] == "unproven"
|
|
assert observability["delivery_context"]["gcp_deployed_sha_proven"] is False
|
|
|
|
|
|
def test_vps_onboarding_and_cory_skills_point_to_current_proof() -> None:
|
|
vps = _skill("teleo-vps-runtime-ops")
|
|
provenance = _skill("teleo-infra-provenance")
|
|
onboarding = _skill("teleo-leo-onboarding")
|
|
cory = _skill("working-leo-cory-outcomes")
|
|
|
|
assert "reasoning tools `17`" in vps
|
|
assert "current source hashes" in vps
|
|
assert "`teleo-auto-deploy.timer`" in vps
|
|
assert "separate state changes" in vps
|
|
assert "/opt/teleo-eval/.last-deploy-sha" in provenance
|
|
assert "does not prove a gateway restart" in " ".join(provenance.split())
|
|
assert "gcp-cloud-sql-t3-live-readonly-current.md" in onboarding
|
|
assert "gcp-leo-runtime-observability-current.md" in onboarding
|
|
assert "GCP Studio authenticated" not in onboarding
|
|
assert "37/37" in cory
|
|
assert "Approved is not the same as applied" in cory
|
|
assert "Next Cory-style follow-up:" in cory
|