Publish curated Unraid-AppOps-Gateway source from a194da2defbd709ea58bd4c9503966dbd37b11f2

backend/tests/test_mcp_hub_governed_topology.py

@@ -2234,6 +2234,37 @@ def test_observed_baseline_is_separate_evidence_and_preserves_unknown_controller
     if os.name != "nt":
         assert stat.S_IMODE(evidence_path.stat().st_mode) == 0o600
 
+@pytest.mark.parametrize("service", ("postgres", "ingestion-clamd"))
+def test_reviewed_security_transition_preserves_the_exact_live_baseline(
+    controller, monkeypatch, tmp_path, service
+):
+    project, _candidate, model, _backup, runtime, _images, state_path, prior = (
+        _observed_live_fixture(controller, monkeypatch, tmp_path)
+    )
+    original_state = state_path.read_bytes()
+    name = f"itworx-mcp-hub-{service}-1"
+    observed_ref = runtime[name]["Config"]["Image"]
+    security_ref = f"gitea.example.com/jens/itworx-mcp-hub/{service}:security-fixture@sha256:{'e' * 64}"
+    bindings = dict(controller.MCP_HUB_APPROVED_EXTERNAL_IMAGE_BINDINGS)
+    bindings[service] += ((security_ref, "fixture:security", security_ref),)
+    monkeypatch.setattr(controller, "MCP_HUB_APPROVED_EXTERNAL_IMAGE_BINDINGS", bindings)
+    transitions = dict(getattr(controller, "MCP_HUB_APPROVED_OBSERVED_EXTERNAL_TRANSITIONS", {}))
+    transitions[service] = {security_ref: (observed_ref, security_ref)}
+    monkeypatch.setattr(controller, "MCP_HUB_APPROVED_OBSERVED_EXTERNAL_TRANSITIONS", transitions, raising=False)
+    model["services"][service]["image"] = security_ref
+
+    verified, facts, observed_model = controller.mcp_hub_verify_observed_baseline(project, prior, model)
+
+    assert verified[name]["Config"]["Image"] == observed_ref
+    assert facts[name]["image_ref"] == observed_ref
+    assert observed_model["services"][service]["image"] == observed_ref
+    assert state_path.read_bytes() == original_state
+    assert controller._mcp_hub_observed_external_ref_allowed(service, security_ref, observed_ref)
+    assert not controller._mcp_hub_observed_external_ref_allowed(service, observed_ref, security_ref)
+    assert not controller._mcp_hub_observed_external_ref_allowed(service, security_ref, observed_ref + "-unexpected")
+    assert not controller._mcp_hub_observed_external_ref_allowed(service, security_ref[:-1] + "0", observed_ref)
+
+
 def test_backup_receipt_validator_rejects_an_unpersisted_boolean_claim(
     controller, monkeypatch, tmp_path
 ):