Publish curated ITWorx_MCP_Hub source from ce7b7c333c5b287456ad4a19c90a4e9b4ee02dcf

tests/test_contextforge_candidate_recipe.py

@@ -43,7 +43,7 @@ def _source_fixture(tmp_path: Path, containerfile: bytes) -> tuple[Path, dict[st
     source.mkdir()
     contents = {
         "Containerfile": containerfile,
-        "pyproject.toml": b"[project]\nname='fixture'\n",
+        "pyproject.toml": b'[project]\nname="fixture"\n[project.optional-dependencies]\npostgres=["psycopg[c,binary]>=3.3.4"]\n',
         "uv.lock": b"version = 1\n",
     }
     expected = {name: _hash(value) for name, value in contents.items()}
@@ -111,6 +111,9 @@ compliance-reference-server = { path = "mcp-servers/python/compliance_reference_
 name = "contextforge"
 dependencies = ["httpx>=0.27"]
 
+[project.optional-dependencies]
+postgres = ["psycopg[c,binary]>=3.3.4"]
+
 [dependency-groups]
 dev = ["pytest>=8"]
 """
@@ -122,6 +125,7 @@ dev = ["pytest>=8"]
     assert parsed["project"] == {
         "name": "contextforge",
         "dependencies": ["httpx>=0.27"],
+        "optional-dependencies": {"postgres": ["psycopg[binary]>=3.3.4"]},
     }
     assert "sources" not in parsed["tool"]["uv"]
     assert parsed["tool"]["uv"]["exclude-newer"] == "2026-09-22T00:00:00Z"
@@ -134,12 +138,36 @@ dev = ["pytest>=8"]
     assert "dev" not in parsed["dependency-groups"]
 
 
+def test_runtime_lock_rejects_source_only_postgres_adapter(monkeypatch) -> None:
+    manifest = recipe._read_lock_manifest()
+    original = recipe._require_file
+
+    def read(path):
+        data = original(path)
+        return data + b"\npsycopg-c==3.3.4\n" if path == recipe.PRODUCTION_LOCK else data
+
+    monkeypatch.setattr(recipe, "_require_file", read)
+    with pytest.raises(recipe.CandidateRecipeError, match="source-only PostgreSQL adapter"):
+        recipe.verify_lock_contents(manifest)
+
+
+@pytest.mark.parametrize("value", ["psycopg[c]>=3.3.4", "psycopg[c,binary]>=3.3.5"])
+def test_binary_adapter_policy_denies_unreviewed_upstream_drift(value) -> None:
+    source = f'[project.optional-dependencies]\npostgres=["{value}"]\n'
+    with pytest.raises(
+        recipe.CandidateRecipeError, match="upstream PostgreSQL adapter contract changed"
+    ):
+        recipe.binary_postgres_pyproject(source)
+
+
 def test_candidate_transform_is_exact_and_uses_hash_locked_runtime_install() -> None:
     original = _containerfile_fixture()
     transformed = recipe.transform_containerfile(original, expected_hash=_hash(original)).decode()
 
     assert transformed.count("COPY contextforge-candidate-production-requirements.txt") == 1
     assert transformed.count("COPY contextforge-candidate-build-tools.txt") == 1
+    assert "COPY pyproject.itworx-candidate.toml /app/pyproject.toml" in transformed
+    assert "assert psycopg.pq.__impl__ == 'binary'" in transformed
     assert (
         "--require-hashes --only-binary=:all: -r /tmp/contextforge-production-requirements.txt"
         in transformed
@@ -213,6 +241,10 @@ def test_prepare_copies_verified_locks_and_fails_before_writing_on_missing_lock(
 
     recipe.prepare_source(source)
     assert (source / "Containerfile.itworx-candidate").exists()
+    assert _hash((source / "pyproject.toml").read_bytes()) == source_hashes["pyproject.toml"]
+    derived = (source / "pyproject.itworx-candidate.toml").read_text()
+    assert '"psycopg[binary]>=3.3.4"' in derived
+    assert "psycopg[c,binary]" not in derived
     for name, target in recipe.LOCK_OUTPUT_NAMES.items():
         assert (source / target).read_bytes() == (lock_dir / name).read_bytes()
 
@@ -333,12 +365,14 @@ def test_frozen_base_evidence_matches_candidate_pins_and_repository_inputs() ->
     assert evidence["status"] == "passed"
     assert evidence["finalContextForgeCandidateBuilt"] is False
     assert evidence["sourceInputs"]["upstreamCommit"] == manifest["upstreamCommit"]
-    assert evidence["sourceInputs"]["ContainerfileSha256"] == manifest["upstreamFiles"][
-        "Containerfile"
-    ]
-    assert evidence["sourceInputs"]["pyprojectTomlSha256"] == manifest["upstreamFiles"][
-        "pyproject.toml"
-    ]
+    assert (
+        evidence["sourceInputs"]["ContainerfileSha256"]
+        == manifest["upstreamFiles"]["Containerfile"]
+    )
+    assert (
+        evidence["sourceInputs"]["pyprojectTomlSha256"]
+        == manifest["upstreamFiles"]["pyproject.toml"]
+    )
     assert evidence["sourceInputs"]["uvLockSha256"] == manifest["upstreamFiles"]["uv.lock"]
     assert set(evidence["hubInputsSha256"]) == {
         "scripts/contextforge_candidate_recipe.py",
@@ -350,9 +384,26 @@ def test_frozen_base_evidence_matches_candidate_pins_and_repository_inputs() ->
         "infrastructure/images/contextforge/os-bases/Dockerfile.runtime",
         "infrastructure/compose/docker-compose.autodeploy.yml",
     }
-    assert evidence["hubInputsSha256"] == {
-        name: _hash((ROOT / name).read_bytes()) for name in evidence["hubInputsSha256"]
+    # The published OS receipt is immutable historical evidence. A later,
+    # explicit Python-only recipe delta binds its changed inputs separately.
+    delta = json.loads((ROOT / "evidence/WP-400/CF_POSTGRES_BINARY_RECIPE.json").read_text())
+    assert delta["schema"] == "itworx.contextforge-postgres-binary-recipe/v1"
+    assert delta["frozenBaseEvidenceSha256"] == _hash(evidence_path.read_bytes())
+    changed = {
+        "scripts/contextforge_candidate_recipe.py",
+        "infrastructure/images/contextforge/candidate/locks.json",
+        "infrastructure/images/contextforge/candidate/production-requirements.lock",
     }
+    assert set(delta["historicalInputsSha256"]) == changed
+    assert set(delta["candidateInputsSha256"]) == changed
+    assert delta["historicalInputsSha256"] == {
+        name: evidence["hubInputsSha256"][name] for name in changed
+    }
+    for name, historical_hash in evidence["hubInputsSha256"].items():
+        expected = delta["candidateInputsSha256"].get(name, historical_hash)
+        assert _hash((ROOT / name).read_bytes()) == expected
+    assert delta["finalCandidateBuilt"] is False
+    assert delta["policy"] == "psycopg[binary]==3.3.4; hash-locked wheels only"
     for role, arg in (("builder", "UBI_BASE"), ("runtime", "UBI_MINIMAL")):
         published = evidence["publishedBases"][role]
         locked = bases[arg]