Publish curated Unraid-AppOps-Gateway source from ba66029223865607deddc234e283c11127324eb8

backend/tests/test_mcp_hub_governed_topology.py

@@ -268,15 +268,49 @@ def test_exact_legacy_target_derives_only_the_fixed_17_service_contract(controll
     assert target["containers"] == list(controller.MCP_HUB_LEGACY_CONTAINERS)
     assert controller.effective_mcp_hub_project("jens/other", target) is target
 
-def test_postgres_candidate_pin_matches_the_reviewed_release_evidence(controller):
-    expected = (
+def test_db_candidate_pins_and_observed_transition_refs_are_exact(controller):
+    postgres = (
+        "gitea.example.com/jens/itworx-mcp-hub/postgres:"
+        "wp400-gosu-v2-20261002-a94e0b4d2029@sha256:"
+        "a60d81e06987671ae903757f1b71cdfbbff4d481b42610e4de2b7dcfa32aad73"
+    )
+    redis = (
+        "gitea.example.com/jens/itworx-mcp-hub/redis:"
+        "wp400-remediation-20261002-4e18f61c@sha256:"
+        "7d826b44f245ad32e8fe4bf40d42eae95855c3942c5f2e42784ee8fd3f9547a2"
+    )
+    assert controller.MCP_HUB_POSTGRES_IMAGE == postgres
+    assert controller.MCP_HUB_REDIS_IMAGE == redis
+    assert controller.MCP_HUB_POSTGRES_PREVIOUS_IMAGE == (
         "postgres:18.6@sha256:0377e72c5289ed2f98cf61b1a9c2db9eb9d300317fe14244492fbc94343b3d04"
     )
-    assert controller.MCP_HUB_POSTGRES_IMAGE == expected
-    assert controller.MCP_HUB_OBSERVED_EXTERNAL_IMAGE_TRANSITIONS["postgres"] == (
-        controller.MCP_HUB_POSTGRES_LEGACY_IMAGE,
-        expected,
+    assert controller.MCP_HUB_REDIS_PREVIOUS_IMAGE == (
+        "redis:8.10.2@sha256:7ef5b5cec96495a04ca7feff88a9492efeab8053fb284d24bdd73344c9245a48"
     )
+    assert controller.MCP_HUB_OBSERVED_EXTERNAL_IMAGE_TRANSITIONS == {
+        "postgres": (
+            (controller.MCP_HUB_POSTGRES_LEGACY_IMAGE, controller.MCP_HUB_POSTGRES_PREVIOUS_IMAGE),
+            postgres,
+        ),
+        "redis": (
+            (controller.MCP_HUB_REDIS_LEGACY_IMAGE, controller.MCP_HUB_REDIS_PREVIOUS_IMAGE),
+            redis,
+        ),
+    }
+
+@pytest.mark.parametrize("service", ["postgres", "redis"])
+def test_db_transition_accepts_only_new_forward_pin_against_exact_observed_refs(controller, service):
+    observed_refs, candidate_ref = controller.MCP_HUB_OBSERVED_EXTERNAL_IMAGE_TRANSITIONS[service]
+    assert controller._mcp_hub_observed_external_ref_allowed(service, candidate_ref, candidate_ref)
+    for old_ref in observed_refs:
+        assert controller._mcp_hub_observed_external_ref_allowed(service, candidate_ref, old_ref)
+        assert not controller._mcp_hub_observed_external_ref_allowed(service, old_ref, old_ref)
+        assert not controller._mcp_hub_observed_external_ref_allowed(service, candidate_ref, old_ref + "-unexpected")
+    assert not controller._mcp_hub_observed_external_ref_allowed(service, candidate_ref + "-unexpected", candidate_ref)
+    other_candidate = (
+        controller.MCP_HUB_REDIS_IMAGE if service == "postgres" else controller.MCP_HUB_POSTGRES_IMAGE
+    )
+    assert not controller._mcp_hub_observed_external_ref_allowed(service, other_candidate, candidate_ref)
 
 def test_installed_legacy_registry_shape_is_adapted_only_in_memory(controller):
     target = {
@@ -1402,7 +1436,7 @@ def test_private_backup_artifacts_publish_atomically_without_overwrite(
 
 @pytest.mark.parametrize(
     "image_ref_name",
-    ["MCP_HUB_POSTGRES_IMAGE", "MCP_HUB_POSTGRES_LEGACY_IMAGE"],
+    ["MCP_HUB_POSTGRES_IMAGE", "MCP_HUB_POSTGRES_PREVIOUS_IMAGE", "MCP_HUB_POSTGRES_LEGACY_IMAGE"],
 )
 def test_live_mount_inventory_includes_volume_identity_source_and_read_only_state(
     controller, monkeypatch, image_ref_name