Publish curated ITWorx_MCP_Hub source from 2a948b17b420decaa9eda9f5754647e4c518bf1e

tests/fixtures/wp200-compose-config.env

@@ -21,3 +21,4 @@ NPM_NETWORK_NAME=itworx-mcp-hub-npm
 INSPECTOR_BIND_IP=127.0.0.1
 COMPOSE_PROFILES=observability
 DEMO_TOKEN_REVOCATIONS_DIR_HOST=/tmp
+APPOPS_BUILD_DATE=2026-10-01T18:00:00Z

tests/test_compose.py

@@ -228,6 +228,87 @@ class ComposeContractTests(unittest.TestCase):
                 f"{name} retains a build definition; local build fallback is possible",
             )
 
+    def test_autodeploy_builds_every_owned_service_with_controller_provenance(self) -> None:
+        overlay = yaml.safe_load(
+            (ROOT / "infrastructure/compose/docker-compose.autodeploy.yml").read_text(
+                encoding="utf-8"
+            )
+        )
+        owned = {name for name, service in self.document["services"].items() if "build" in service}
+        self.assertTrue(owned)
+        for name in owned:
+            with self.subTest(service=name):
+                self.assertIn(name, overlay["services"])
+                service = overlay["services"][name]
+                self.assertIn("${GITEA_COMMIT_SHA:?", service["image"])
+                arguments = service["build"].get("args", {})
+                self.assertEqual(
+                    arguments.get("GIT_REVISION"),
+                    "${GITEA_COMMIT_SHA:?GITEA_COMMIT_SHA is required}",
+                )
+                self.assertEqual(
+                    arguments.get("BUILD_DATE"),
+                    "${APPOPS_BUILD_DATE:?APPOPS_BUILD_DATE is required}",
+                )
+                original_arguments = self.document["services"][name]["build"].get("args", {})
+                for key, value in original_arguments.items():
+                    self.assertEqual(arguments.get(key), value)
+
+    def test_real_autodeploy_preserves_intake_digest_and_owned_build_revision(self) -> None:
+        docker = shutil.which("docker")
+        if docker is None:
+            self.skipTest("docker CLI is not available in this environment")
+        revision = "a" * 40
+        built_at = "2026-10-01T18:00:00Z"
+        with tempfile.TemporaryDirectory() as secrets_dir:
+            for name in self.document["secrets"]:
+                (Path(secrets_dir) / name).write_text("test-fixture-secret\n", encoding="utf-8")
+            command = [docker, "compose", "--profile", "knowledge-intake"]
+            for filename in (
+                "docker-compose.yml",
+                "docker-compose.prod.yml",
+                "docker-compose.autodeploy.yml",
+                "docker-compose.ingestion.prod.yml",
+            ):
+                command.extend(["-f", str(COMPOSE.parent / filename)])
+            command.extend(
+                [
+                    "--env-file",
+                    str(ROOT / "tests/fixtures/wp200-compose-config.env"),
+                    "config",
+                    "--format",
+                    "json",
+                ]
+            )
+            completed = subprocess.run(  # noqa: S603
+                command,
+                capture_output=True,
+                text=True,
+                check=False,
+                env={
+                    **os.environ,
+                    "SECRETS_DIR": secrets_dir,
+                    "COMPOSE_PROFILES": "",
+                    "CONNECTOR_INGESTION_IMAGE": f"registry.example.test/intake@sha256:{'b' * 64}",
+                    "GITEA_COMMIT_SHA": revision,
+                    "APPOPS_BUILD_DATE": built_at,
+                },
+            )
+        self.assertEqual(completed.returncode, 0, completed.stderr)
+        rendered = json.loads(completed.stdout)
+        self.assertEqual(len(rendered["services"]), 17)
+        self.assertEqual(
+            rendered["services"]["connector-ingestion"]["image"],
+            f"registry.example.test/intake@sha256:{'b' * 64}",
+        )
+        self.assertNotIn("build", rendered["services"]["connector-ingestion"])
+        for name, service in rendered["services"].items():
+            if "build" not in service:
+                continue
+            self.assertEqual(service["build"]["args"]["GIT_REVISION"], revision, name)
+            self.assertEqual(service["build"]["args"]["BUILD_DATE"], built_at, name)
+            self.assertTrue(service["image"].endswith(f":{revision}"), name)
+
     def test_unraid_folder_view_groups_the_complete_production_stack(self) -> None:
         definition_path = ROOT / "infrastructure" / "unraid" / "folder-view3-itworx-mcp-hub.json"
         definition = json.loads(definition_path.read_text(encoding="utf-8"))

tests/test_wp280_runtime_quality.py

@@ -67,11 +67,11 @@ def test_base_security_layer_pins_and_verifies_staging_fixed_versions() -> None:
     )
     fixed_packages = {
         "gzip": ("gzip", "1.13-1+deb13u1"),
-        "libpcre2-8-0": ("pcre2", "10.46-1~deb13u2"),
+        "libpcre2-8-0": ("pcre2", "10.46-1~deb13u3"),
         "libsqlite3-0": ("sqlite3", "3.46.1-7+deb13u2"),
-        "libssl3t64": ("openssl", "3.5.7-1~deb13u2"),
-        "openssl": ("openssl", "3.5.7-1~deb13u2"),
-        "openssl-provider-legacy": ("openssl", "3.5.7-1~deb13u2"),
+        "libssl3t64": ("openssl", "3.5.7-1~deb13u3"),
+        "openssl": ("openssl", "3.5.7-1~deb13u3"),
+        "openssl-provider-legacy": ("openssl", "3.5.7-1~deb13u3"),
         "perl-base": ("perl_base", "5.40.1-6+deb13u1"),
     }
     for package, (variable, version) in fixed_packages.items():