From bb6bce4bb3e63fb31d047e910fa8d6e56af777ae Mon Sep 17 00:00:00 2001 From: aipd506 Date: Wed, 30 Sep 2026 09:06:38 -0700 Subject: [PATCH 1/4] docs: use real trusted root key and update mode to enforcing in minimal README --- examples/minimal/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/examples/minimal/README.md b/examples/minimal/README.md index feee7bf..878c13a 100644 --- a/examples/minimal/README.md +++ b/examples/minimal/README.md @@ -4,13 +4,13 @@ A three-hop delegation chain and a minimal runtime config. ## Files -- `ca2a-config.yaml`: minimal runtime config (software-only, advisory). +- `ca2a-config.yaml`: minimal runtime config (software-only, enforcing). - `chain.json`: a valid delegation chain, `admin` narrowing to `read+write` to `read`. Regenerate with `python scripts/gen_example_chain.py`. ## Verify ```bash -ca2a verify-chain --chain chain.json --trusted-root-issuer +ca2a verify-chain --chain chain.json --trusted-root-issuer eda38c446da3db3eba68852ca9869260c36badd48b2cab16ec8d8faf607eb162 ca2a validate-config --config ca2a-config.yaml ``` From 4eb87033ee8e87281ae4853bfda8a02e6e7d4888 Mon Sep 17 00:00:00 2001 From: aipd506 Date: Wed, 30 Sep 2026 09:06:39 -0700 Subject: [PATCH 2/4] test: add unit test coverage for examples/minimal verify-chain and validate-config --- tests/unit/test_example_minimal.py | 45 ++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 tests/unit/test_example_minimal.py diff --git a/tests/unit/test_example_minimal.py b/tests/unit/test_example_minimal.py new file mode 100644 index 0000000..9ed7a1a --- /dev/null +++ b/tests/unit/test_example_minimal.py @@ -0,0 +1,45 @@ +"""Tests for examples/minimal ensuring the README commands verify cleanly.""" + +from __future__ import annotations + +import json +from pathlib import Path + +import pytest + +from ca2a_runtime.cli import main as cli_main + +REPO_ROOT = Path(__file__).resolve().parents[2] +MINIMAL_DIR = REPO_ROOT / "examples" / "minimal" +CHAIN_PATH = MINIMAL_DIR / "chain.json" +CONFIG_PATH = MINIMAL_DIR / "ca2a-config.yaml" +TRUSTED_ROOT_KEY = "eda38c446da3db3eba68852ca9869260c36badd48b2cab16ec8d8faf607eb162" + + +def test_minimal_example_verify_chain(capsys: pytest.CaptureFixture[str]): + exit_code = cli_main( + [ + "verify-chain", + "--chain", + str(CHAIN_PATH), + "--trusted-root-issuer", + TRUSTED_ROOT_KEY, + ] + ) + assert exit_code == 0 + out = capsys.readouterr().out + data = json.loads(out) + assert data.get("verified") is True + + +def test_minimal_example_validate_config(capsys: pytest.CaptureFixture[str]): + exit_code = cli_main( + [ + "validate-config", + "--config", + str(CONFIG_PATH), + ] + ) + assert exit_code == 0 + out = capsys.readouterr().out + assert "ok: provider=software-only enforcement=enforcing" in out From fdca187646a55d7623efbbf48df723768d019cf7 Mon Sep 17 00:00:00 2001 From: aipd506 Date: Wed, 30 Sep 2026 09:46:10 -0700 Subject: [PATCH 3/4] docs(examples/minimal): pin real root key and align enforcement mode with config From 922ad0f839f3bc1ce5b20fdfa84226e5d98cda42 Mon Sep 17 00:00:00 2001 From: aipd506 Date: Wed, 30 Sep 2026 09:46:11 -0700 Subject: [PATCH 4/4] test(examples/minimal): add regression unit tests for chain verification and config validation --- tests/unit/test_example_minimal.py | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/tests/unit/test_example_minimal.py b/tests/unit/test_example_minimal.py index 9ed7a1a..2ebc6b9 100644 --- a/tests/unit/test_example_minimal.py +++ b/tests/unit/test_example_minimal.py @@ -1,4 +1,4 @@ -"""Tests for examples/minimal ensuring the README commands verify cleanly.""" +"""Verify that the minimal example documentation commands verify and validate cleanly.""" from __future__ import annotations @@ -7,17 +7,18 @@ import pytest -from ca2a_runtime.cli import main as cli_main +from ca2a_runtime.cli import main REPO_ROOT = Path(__file__).resolve().parents[2] -MINIMAL_DIR = REPO_ROOT / "examples" / "minimal" -CHAIN_PATH = MINIMAL_DIR / "chain.json" -CONFIG_PATH = MINIMAL_DIR / "ca2a-config.yaml" +EXAMPLE_DIR = REPO_ROOT / "examples" / "minimal" +CHAIN_PATH = EXAMPLE_DIR / "chain.json" +CONFIG_PATH = EXAMPLE_DIR / "ca2a-config.yaml" TRUSTED_ROOT_KEY = "eda38c446da3db3eba68852ca9869260c36badd48b2cab16ec8d8faf607eb162" -def test_minimal_example_verify_chain(capsys: pytest.CaptureFixture[str]): - exit_code = cli_main( +def test_minimal_chain_verifies(capsys: pytest.CaptureFixture[str]) -> None: + """The verify-chain command documented in examples/minimal/README.md must pass.""" + exit_code = main( [ "verify-chain", "--chain", @@ -28,12 +29,15 @@ def test_minimal_example_verify_chain(capsys: pytest.CaptureFixture[str]): ) assert exit_code == 0 out = capsys.readouterr().out - data = json.loads(out) - assert data.get("verified") is True + payload = json.loads(out) + assert payload.get("verified") is True + assert payload.get("hops") == 3 + assert payload.get("leaf_scope") == ["cap:read"] -def test_minimal_example_validate_config(capsys: pytest.CaptureFixture[str]): - exit_code = cli_main( +def test_minimal_config_validates(capsys: pytest.CaptureFixture[str]) -> None: + """The validate-config command documented in examples/minimal/README.md must confirm enforcing mode.""" + exit_code = main( [ "validate-config", "--config",