Publish curated ITWorx_MCP_Hub source from 5d65966d0393e868ed5df1d95a21412a4c587d78

tests/test_compose.py

@@ -19,6 +19,35 @@ class ComposeContractTests(unittest.TestCase):
     def setUpClass(cls) -> None:
         cls.document = yaml.safe_load(COMPOSE.read_text(encoding="utf-8"))
 
+    def assert_database_candidate_pin(
+        self,
+        name: str,
+        image_ref: str,
+        image_evidence: dict,
+        publication: dict,
+        publication_candidate: dict,
+    ) -> None:
+        artifact = image_evidence["artifact"]
+        published = artifact["publishedImage"]
+        self.assertRegex(
+            image_ref,
+            rf"^gitea\.itworx\.tech/jens/itworx-mcp-hub/{name}:[^@]+@sha256:[0-9a-f]{{64}}$",
+        )
+        image_name, digest = image_ref.split("@", maxsplit=1)
+        self.assertEqual(published["reference"], image_ref)
+        self.assertEqual(published["taggedReference"], image_name)
+        self.assertEqual(published["manifestDigest"], digest)
+        self.assertEqual(published["imageId"], artifact["imageId"])
+        self.assertTrue(published["immutablePullConfigMatchedScannedImage"])
+        self.assertEqual(published["sourceReceiptSha256"], publication["sourceReceiptSha256"])
+        self.assertEqual(publication_candidate["reference"], image_ref)
+        self.assertEqual(publication_candidate["manifestDigest"], digest)
+        self.assertEqual(publication_candidate["scannedImageId"], artifact["imageId"])
+        self.assertEqual(publication_candidate["pulledImageId"], artifact["imageId"])
+        self.assertTrue(publication_candidate["immutablePullConfigMatchedScannedImage"])
+        self.assertEqual(image_evidence["humanRiskAcceptance"], "pending")
+        self.assertFalse(image_evidence["productionDeployment"])
+
     def test_all_images_are_immutable_or_local_dev(self) -> None:
         for name, service in self.document["services"].items():
             image = service.get("image", "")
@@ -68,9 +97,94 @@ class ComposeContractTests(unittest.TestCase):
         for name in ("postgres", "redis"):
             with self.subTest(service=name):
                 image = self.document["services"][name]["image"]
-                self.assertRegex(image, r"^[a-z]+:[0-9.]+@sha256:[0-9a-f]{64}$")
+                self.assertRegex(
+                    image,
+                    r"^gitea\.itworx\.tech/jens/itworx-mcp-hub/"
+                    rf"{name}:[^@]+@sha256:[0-9a-f]{{64}}$",
+                )
                 self.assertEqual(integration["services"][name]["image"], image)
 
+    def test_database_candidate_pins_bind_to_published_scan_identities(self) -> None:
+        evidence_path = ROOT / "evidence/WP-400/DATABASE_REMEDIATION_SCANS.json"
+        evidence = json.loads(evidence_path.read_text(encoding="utf-8"))
+        publication = evidence["publication"]
+        publication_proof = json.loads(
+            (ROOT / "evidence/WP-400/DATABASE_CANDIDATE_PUBLICATION_20261003.json").read_text(
+                encoding="utf-8"
+            )
+        )
+        self.assertEqual(
+            publication,
+            {key: value for key, value in publication_proof.items() if key != "candidates"},
+        )
+        self.assertFalse(evidence["productionDeployment"])
+        self.assertFalse(publication["productionDeployment"])
+        self.assertFalse(publication["cveRiskAccepted"])
+        self.assertEqual(publication["status"], "published_digest_verified")
+        self.assertRegex(publication["sourceReceiptSha256"], r"^[0-9a-f]{64}$")
+
+        integration = yaml.safe_load(
+            (ROOT / "infrastructure/compose/docker-compose.wp050-integration.yml").read_text(
+                encoding="utf-8"
+            )
+        )
+        for name in ("postgres", "redis"):
+            with self.subTest(service=name):
+                image_evidence = evidence["images"][name]
+                image_ref = image_evidence["artifact"]["publishedImage"]["reference"]
+                candidate_proof = publication_proof["candidates"][name]
+                self.assert_database_candidate_pin(
+                    name,
+                    self.document["services"][name]["image"],
+                    image_evidence,
+                    publication,
+                    candidate_proof,
+                )
+                self.assert_database_candidate_pin(
+                    name,
+                    integration["services"][name]["image"],
+                    image_evidence,
+                    publication,
+                    candidate_proof,
+                )
+                self.assertEqual(image_ref, self.document["services"][name]["image"])
+                self.assertEqual(image_ref, integration["services"][name]["image"])
+
+    def test_database_candidate_pin_contract_rejects_tag_only_and_config_drift(self) -> None:
+        evidence = json.loads(
+            (ROOT / "evidence/WP-400/DATABASE_REMEDIATION_SCANS.json").read_text(encoding="utf-8")
+        )
+        publication_proof = json.loads(
+            (ROOT / "evidence/WP-400/DATABASE_CANDIDATE_PUBLICATION_20261003.json").read_text(
+                encoding="utf-8"
+            )
+        )
+        for name in ("postgres", "redis"):
+            with self.subTest(service=name):
+                artifact = evidence["images"][name]["artifact"]
+                published = artifact["publishedImage"]
+                valid_ref = published["reference"]
+                tag_only = valid_ref.split("@", maxsplit=1)[0]
+                with self.assertRaises(AssertionError):
+                    self.assert_database_candidate_pin(
+                        name,
+                        tag_only,
+                        evidence["images"][name],
+                        evidence["publication"],
+                        publication_proof["candidates"][name],
+                    )
+                mismatched_image = dict(published, imageId="sha256:" + "0" * 64)
+                drifted_evidence = dict(evidence["images"][name])
+                drifted_evidence["artifact"] = dict(artifact, publishedImage=mismatched_image)
+                with self.assertRaises(AssertionError):
+                    self.assert_database_candidate_pin(
+                        name,
+                        valid_ref,
+                        drifted_evidence,
+                        evidence["publication"],
+                        publication_proof["candidates"][name],
+                    )
+
     def test_inspector_is_lan_only_optional_profile(self) -> None:
         inspector = self.document["services"]["inspector"]
         self.assertEqual(inspector.get("profiles"), ["inspector"])