Repository navigation

test: add controlled DNS resolver for native egress tests - #46

Merged

senamakel merged 102 commits into

mainfrom

epic-7328-continue

Oct 23, 2026

Merged

test: add controlled DNS resolver for native egress tests#46
senamakel merged 102 commits into
mainfrom
epic-7328-continue

Commits on Oct 23, 2026
- feat(tinysecurity-module): add native-security-tests feature
  
  senamakel
  and
  medullabot
  committed
  f517c3e
- feat(native_test_resolver): add deterministic fixture resolver for native tests
  
  senamakel
  and
  medullabot
  committed
  89a5373
- Merge remote-tracking branch 'origin/main' into epic-7328-continue
  senamakel
  committed
  ce27627
- refactor(tinysecurity-module): route egress checks through a resolver accessor
  
  senamakel
  and
  medullabot
  committed
  de7fd53
- refactor(native-test-resolver): simplify fallback and tidy tests
  
  senamakel
  and
  medullabot
  committed
  d61b9c0
- fix(tinysecurity-module): gate native test resolver on debug builds
  
  senamakel
  and
  medullabot
  committed
  04f9c09
- test(native): cover mixed-case host key resolution
  
  senamakel
  and
  medullabot
  committed
  c326322
- fix(tinysecurity-module): reject duplicate fixture hostnames
  
  senamakel
  and
  medullabot
  committed
  57d11dd
- test(tinysecurity-module): return result from mixed-case host key test
  
  senamakel
  and
  medullabot
  committed
  27d99de
- Document the native DNS test fixture
  
  senamakel
  and
  medullabot
  committed
  5ed1d42
- test(native): cover duplicate host keys in invalid fixture inputs
  
  senamakel
  and
  medullabot
  committed
  e2e4a87
- fix(tinysecurity-module): reject duplicate hostnames in dns fixtures
  
  senamakel
  and
  medullabot
  committed
  9e43459
- style: reorder imports in native test resolver
  
  senamakel
  and
  medullabot
  committed
  467ed1e
- test(tinysecurity-module): cover fixture resolver bounds and failure paths
  
  senamakel
  and
  medullabot
  committed
  d2d217e
- refactor(native-test-resolver): extract fixture parsing into a testable function
  
  senamakel
  and
  medullabot
  committed
  51f9ee6
- test(native): return result from resolver rejection test
  
  senamakel
  and
  medullabot
  committed
  ed63e62
- test: tolerate Windows coverage overhead in cipher fixtures
  
  senamakel
  and
  medullabot
  committed
  d8707a0
- test: let cipher replay assertions observe module rejection
  
  senamakel
  and
  medullabot
  committed
  c18b56f
- feat(native_handles): add register_scope for live registries
  
  senamakel
  and
  medullabot
  committed
  0867aa0
- test(crypto): cover scope registration generation checks
  
  senamakel
  and
  medullabot
  committed
  1d91ba6
- fix(tinysecurity-crypto): reject stale scope registrations
  
  senamakel
  and
  medullabot
  committed
  59ab3d1
- feat(bus): add runtime secret scope registration method
  
  senamakel
  and
  medullabot
  committed
  7994e67
- feat(approval): add scope_snapshot accessor for live registrations
  
  senamakel
  and
  medullabot
  committed
  4cf86e8
- feat(module): support dynamic secret registrations
  
  senamakel
  and
  medullabot
  committed
  bef5153
- feat(secret): add dynamic secret scope registration and retirement
  
  senamakel
  and
  medullabot
  committed
  b81f2ca
- feat(module): register secret scopes and retire them with approval scopes
  
  senamakel
  and
  medullabot
  committed
  6694582
- refactor(adapter_secret): simplify secret state iteration and borrows
  
  senamakel
  and
  medullabot
  committed
  1e3896e
- test(adapter): cover secret scope registration and retirement
  
  senamakel
  and
  medullabot
  committed
  5c8eb2e
- test(adapter-secret): cover mode 22 denial in master resolution test
  
  senamakel
  and
  medullabot
  committed
  439fca3
- test(adapter-secret): cover runtime secret registration approval scope
  
  senamakel
  and
  medullabot
  committed
  521a9b6
- test(adapter-secret): simplify mode 22 assertion and fix signature formatting
  
  senamakel
  and
  medullabot
  committed
  3d4a58e
- test(adapter-secret): add trace output to runtime secret exercise
  
  senamakel
  and
  medullabot
  committed
  fce7bf3
- test(adapter-secret): register approval scope through proxy in runtime exercise
  
  senamakel
  and
  medullabot
  committed
  a432d47
- test(adapter-secret): use hex ids in secret scope fixtures
  
  senamakel
  and
  medullabot
  committed
  5402803
- fix(secret): check dynamic registrations before re-registering
  
  senamakel
  and
  medullabot
  committed
  316aa9a
- test(bus): update contract version expectations to 1.29
  
  senamakel
  and
  medullabot
  committed
  88c41f4
- test(adapter-secret): reformat assertion for readability
  
  senamakel
  and
  medullabot
  committed
  fff0b2a
- test(adapter-secret): cast registration counts to usize
  
  senamakel
  and
  medullabot
  committed
  3456127
- docs: add runtime secret scopes contract for 1.29
  
  senamakel
  and
  medullabot
  committed
  37fb952
- docs: document runtime secret scopes contract 1.29
  
  senamakel
  and
  medullabot
  committed
  4144fad
- test(adapter-secret): cover scope replacement and secret re-registration
  
  senamakel
  and
  medullabot
  committed
  6fe5572
- chore(bus): reorder method name entries
  
  senamakel
  and
  medullabot
  committed
  685b4a7
- test(crypto): cover scope replacement fencing old reservations
  
  senamakel
  and
  medullabot
  committed
  4de953e
- feat(native_handles): add replace_scope to update a live scope's policy
  
  senamakel
  and
  medullabot
  committed
  b3dee49
- fix(secret): guard approval scope with rwlock and refresh on change
  
  senamakel
  and
  medullabot
  committed
  9788ae1
- fix(module): refresh approval scope after replacing it
  
  senamakel
  and
  medullabot
  committed
  826b48b
- style: reformat adapter_secret for rustfmt compliance
  
  senamakel
  and
  medullabot
  committed
  84299f1
- test(adapter-secret): cover re-registration with a reused policy ref
  
  senamakel
  and
  medullabot
  committed
  1a6b62e
- fix(native_handles): reject operations on deactivated scopes
  
  senamakel
  and
  medullabot
  committed
  2f98856
- test(crypto): cover revoked scope re-registration and replacement
  
  senamakel
  and
  medullabot
  committed
  f0a7354
- test(crypto): reformat revoked scope assertions
  
  senamakel
  and
  medullabot
  committed
  48ce317
- docs(specs): document tombstoning of revoked runtime secret ids
  
  senamakel
  and
  medullabot
  committed
  8c7ec6e
- refactor(crypto): take registration by reference in replace_scope
  
  senamakel
  and
  medullabot
  committed
  4653dbf
- fix(tinysecurity-crypto): correct borrows in native handle registry
  
  senamakel
  and
  medullabot
  committed
  e507098
- fix(tinysecurity-crypto): correct registration reference in scope checks
  
  senamakel
  and
  medullabot
  committed
  469a801
- chore(adapter): note async bus interface in secret scope registration
  
  senamakel
  and
  medullabot
  committed
  4bf677c
- refactor(adapter_secret): simplify scope retention predicate
  
  senamakel
  and
  medullabot
  committed
  e7347bc
- fix(adapter): serialize secret scope lifecycle operations
  
  senamakel
  and
  medullabot
  committed
  0e3d8fd
- fix(tinysecurity-module): retire approval scopes after engine updates
  
  senamakel
  and
  medullabot
  committed
  c6fc837
- fix(tinysecurity-module): retire approval scope before replacing or retiring it
  
  senamakel
  and
  medullabot
  committed
  0a2badb
- refactor(adapter): move secret scope lifecycle lock to a static
  
  senamakel
  and
  medullabot
  committed
  802648b
- fix(tinysecurity-module): retire approval scope after engine call
  
  senamakel
  and
  medullabot
  committed
  74fbe99
- fix(adapter): serialize secret scope registration with lifecycle lock
  
  senamakel
  and
  medullabot
  committed
  aeeb66c
- fix(adapter): serialize scope registration and retirement
  
  senamakel
  and
  medullabot
  committed
  9968f23
- style: reformat approval scope code and tests
  
  senamakel
  and
  medullabot
  committed
  3eb7e6a
- test(policy): cover host skill scan verdicts and denial precedence
  
  senamakel
  and
  medullabot
  committed
  88f5c4f
- feat(bus): add skill scan verdict check to policy contract
  
  senamakel
  and
  medullabot
  committed
  dae1135
- fix(approval): treat skill scan checks as non-external
  
  senamakel
  and
  medullabot
  committed
  f205ed7
- test(policy): import SkillScanVerdict in engine tests
  
  senamakel
  and
  medullabot
  committed
  f6256bb
- test(tinysecurity-policy): rename loop variable in skill scan verdict test
  
  senamakel
  and
  medullabot
  committed
  9a950f5
- feat(policy): bind skill scan approvals to bundle digest
  
  senamakel
  and
  medullabot
  committed
  fecf3bc
- docs: document host skill-scan contract 1.29
  
  senamakel
  and
  medullabot
  committed
  893ef9c
- test(approval): cover skill scan warn and block verdicts
  
  senamakel
  and
  medullabot
  committed
  5c4abe5
- test(approval): assert denied lifecycle state instead of error
  
  senamakel
  and
  medullabot
  committed
  b8be187
- test(approval): narrow skill scan test to human approval path
  
  senamakel
  and
  medullabot
  committed
  d2d1187
- docs: expand skill-scan contract 1.29 spec
  
  senamakel
  and
  medullabot
  committed
  5599b28
- test(approval): cover skill scan block under auto-approve scope
  
  senamakel
  and
  medullabot
  committed
  a5fdecc
- fix(approval): require human approval for blocked and warned skill scans
  
  senamakel
  and
  medullabot
  committed
  09fdf07
- test(adapter-host): cover host skill scan verdicts before run_workflow
  
  senamakel
  and
  medullabot
  committed
  2237f3b
- refactor(approval): extract blocked skill scan check and flatten conditionals
  
  senamakel
  and
  medullabot
  committed
  758a779
- test(policy): cover skill scan pass without effect check
  
  senamakel
  and
  medullabot
  committed
  e94c723
- fix(policy): stop treating skill scan checks as host tool calls
  
  senamakel
  and
  medullabot
  committed
  4adef47
- docs: clarify skill scan is supplemental and additive for 1.28 hosts
  
  senamakel
  and
  medullabot
  committed
  2f85664
- test(policy): simplify contract version test setup
  
  senamakel
  and
  medullabot
  committed
  8dfbb39
- test(adapter-host-tool): cover skill scan checks in admission-only detection
  
  senamakel
  and
  medullabot
  committed
  7721860
- fix(adapter): treat skill scans as admission-only checks
  
  senamakel
  and
  medullabot
  committed
  d9d2590
- style: reformat admission_only check for readability
  
  senamakel
  and
  medullabot
  committed
  24ef88e
- docs(tinysecurity-module): clarify admission_only doc comment
  
  senamakel
  and
  medullabot
  committed
  0e8e631
- test: isolate process-owned confidential fixtures in child processes
  
  senamakel
  and
  medullabot
  committed
  e7f1b32
- test(adapter-secret): cover static registration and conflicting backend
  
  senamakel
  and
  medullabot
  committed
  fe5bf95
- style: format runtime registration coverage tests
  
  senamakel
  and
  medullabot
  committed
  4af2af2
- fix(secret): refresh cipher audit policy on scope replacement
  
  senamakel
  and
  medullabot
  committed
  10453d7
- chore(tinysecurity-module): gate audit_policy_ref behind cfg(test)
  
  senamakel
  and
  medullabot
  committed
  44499c4
- test(adapter): serialize secret scope tests with a shared lock
  
  senamakel
  and
  medullabot
  committed
  e71c68c
- test(adapter): isolate process-global secret scope tests
  
  senamakel
  and
  medullabot
  committed
  ca5b4d0
- test(adapter-secret): drop redundant lock and inline result type
  
  senamakel
  and
  medullabot
  committed
  5227651
- fix(module): pass secret cipher state into approval scope refresh
  
  senamakel
  and
  medullabot
  committed
  6ddd02a
- test: remove process isolation helper from secret adapter tests
  
  senamakel
  and
  medullabot
  committed
  57cc91c
- Merge branch 'skill-scan-risk-7328' into runtime-secret-scopes-129
  senamakel
  committed
  d57aafa
- test(secret): cover orphaned pending scope cleanup
  
  senamakel
  and
  medullabot
  committed
  f391368
- fix(secret): prune orphaned pending scope calls
  
  senamakel
  and
  medullabot
  committed
  6458de1
- Merge pull request #47 from tinyhumansai/runtime-secret-scopes-129
  senamakel
  authored
  068bb33

Commits

Commits on Oct 23, 2026