Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

tests/test_contextforge_runtime_wiring.py

@@ -0,0 +1,64 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+PROD = ROOT / "infrastructure" / "compose" / "docker-compose.prod.yml"
+ENTRYPOINT = ROOT / "infrastructure" / "images" / "contextforge" / "entrypoint.sh"
+
+
+def _prod_contextforge_block() -> str:
+    source = PROD.read_text(encoding="utf-8")
+    return source.split("  contextforge:\n", 1)[1].split("  control-api:", 1)[0]
+
+
+def test_strict_production_contract_cannot_be_weakened() -> None:
+    service = _prod_contextforge_block()
+    assert "image: itworx-mcp-hub/contextforge-schema:12d4a0c7789c" in service
+    assert "pull_policy: never" in service
+    expected = {
+        "GUNICORN_WORKERS": "1",
+        "USE_STATEFUL_SESSIONS": "false",
+        "MCPGATEWAY_SESSION_AFFINITY_ENABLED": "false",
+        "JSON_RESPONSE_ENABLED": "true",
+        "EMAIL_AUTH_ENABLED": "false",
+        "MCP_SESSION_POOL_ENABLED": "false",
+        "MCPGATEWAY_SKIP_MIGRATIONS": "true",
+        "ITWORX_CONTEXTFORGE_CONTRACT_MODE": "strict",
+    }
+    for name, value in expected.items():
+        assert f'{name}: "{value}"' in service
+    for mount in (
+        "../images/contextforge/entrypoint.sh:/opt/itworx/contextforge-entrypoint.sh:ro",
+        (
+            "../images/contextforge/runtime-contract.json:"
+            "/opt/itworx/contextforge-runtime-contract.json:ro"
+        ),
+        (
+            "../../scripts/contextforge_runtime_contract.py:"
+            "/opt/itworx/contextforge-runtime-contract.py:ro"
+        ),
+    ):
+        assert f'"{mount}"' in service
+    assert (
+        'ITWORX_CONTEXTFORGE_EXPECTED_CONTRACT_SHA256: '
+        '"11345ea89e229e7bf164eb037b525b685a5dfb143c08a220544c0b6cdde411d9"'
+        in service
+    )
+
+
+def test_entrypoint_runs_read_only_contract_gate_before_upstream_startup() -> None:
+    source = ENTRYPOINT.read_text(encoding="utf-8")
+    verify = "/app/.venv/bin/python /opt/itworx/contextforge-runtime-contract.py --startup"
+    upstream = "exec /app/docker-entrypoint.sh"
+    assert verify in source
+    assert source.index(verify) < source.index(upstream)
+    assert 'ITWORX_CONTEXTFORGE_CONTRACT_MODE:-relaxed' in source
+
+
+def test_production_contextforge_healthcheck_combines_contract_and_http_health() -> None:
+    service = _prod_contextforge_block()
+    assert "contextforge-runtime-contract.py --health" in service
+    assert "http://127.0.0.1:4444/health" in service
+    assert "interval: 30s" in service
+    assert "retries: 3" in service