Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

backend/tests/test_release_provenance_v121.py

@@ -36,8 +36,9 @@ RELEASE_BUILD = ROOT / "scripts" / "release_build.py"
 FRONTEND_DOCKERFILE = ROOT / "frontend" / "Dockerfile"
 NODE_AGENT_DOCKERFILE = ROOT / "node-agent" / "Dockerfile"
 
-#: Every image the release builder publishes. The Runtime Worker is a first-class private runtime
-#: artifact even though it exposes no public listener.
+#: Every image the release builder publishes. The Runtime Worker is a first-class release image:
+#: the remote GPU projection may still build locally for development, but an RC installs its exact
+#: immutable tag rather than reconstructing it from source.
 RELEASE_IMAGES = (
     "modelforge-api",
     "modelforge-web",
@@ -149,7 +150,7 @@ def test_the_console_csp_is_derived_from_the_same_origin_argument() -> None:
     dockerfile = FRONTEND_DOCKERFILE.read_text(encoding="utf-8")
     assert 'API_ORIGIN=$(printf \'%s\' "${VITE_API_BASE_URL}" | cut -d/ -f1-3)' in dockerfile
     # The build fails rather than shipping a policy with an unsubstituted placeholder.
-    assert 'grep -q "connect-src \'self\' ${API_ORIGIN};"' in dockerfile
+    assert 'grep -q "connect-src ${API_ORIGIN};"' in dockerfile
 
 
 def test_the_console_csp_is_never_widened_to_a_wildcard() -> None:
@@ -157,7 +158,7 @@ def test_the_console_csp_is_never_widened_to_a_wildcard() -> None:
     connect = [line for line in template.splitlines() if "connect-src" in line]
     assert connect, "the template must define connect-src"
     for line in connect:
-        assert "connect-src 'self' __API_ORIGIN__" in line
+        assert "connect-src __API_ORIGIN__" in line
         assert "*" not in line.split("connect-src", 1)[1].split(";")[0]
 
 
@@ -228,6 +229,16 @@ def test_the_node_agent_compose_build_passes_the_release_identity() -> None:
     assert args["MODELFORGE_BUILT_AT"] == "${MODELFORGE_BUILT_AT:-}"
 
 
+def test_the_runtime_worker_compose_projection_accepts_an_exact_release_image() -> None:
+    worker = _compose("docker-compose.runtime-worker.yml")["services"]["runtime-worker"]
+    assert "MODELFORGE_RUNTIME_WORKER_IMAGE" in worker["image"]
+    assert "latest" not in worker["image"]
+    args = worker["build"]["args"]
+    assert args["MODELFORGE_VERSION"] == "${MODELFORGE_VERSION:-0.0.0}"
+    assert args["MODELFORGE_COMMIT"] == "${MODELFORGE_COMMIT:-}"
+    assert args["MODELFORGE_BUILT_AT"] == "${MODELFORGE_BUILT_AT:-}"
+
+
 def test_every_composed_release_image_passes_the_release_identity() -> None:
     """Whatever builds a published image must stamp it; otherwise the tag is the only identity."""
 
@@ -252,14 +263,6 @@ def test_the_node_agent_image_reference_is_versioned_and_never_floating() -> Non
     assert ":latest" not in reference
 
 
-def test_the_runtime_worker_image_reference_is_versioned_and_never_floating() -> None:
-    service = _compose("docker-compose.runtime-worker.yml")["services"]["runtime-worker"]
-    reference = service["image"]
-    assert "${MODELFORGE_RUNTIME_WORKER_IMAGE:-" in reference
-    assert "${MODELFORGE_VERSION:-local}" in reference
-    assert ":latest" not in reference
-
-
 def test_the_agent_version_derives_from_the_repository_version_file() -> None:
     """Single-source versioning: VERSION drives every packaged manifest.