release: freeze Nexus One AI 1.0.0-rc1

tests/deployment/test_offline_payload_lock.py

@@ -0,0 +1,89 @@
+import json
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+VALIDATOR = ROOT / "autoinstall/offline/validate-payload-lock.py"
+CANDIDATE = ROOT / "autoinstall/offline/payload-lock.candidate.json"
+
+
+def run(lock: Path) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        [sys.executable, str(VALIDATOR), str(lock)],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+
+
+def complete_lock() -> dict:
+    digest = "a" * 64
+    groups = {}
+    for group in ("apt", "python", "runtime", "models", "source"):
+        groups[group] = [{
+            "id": f"test-{group}",
+            "version": "1.0.0-test",
+            "architecture": "amd64" if group != "source" else "all",
+            "source": f"https://invalid.example/{group}/1.0.0-test",
+            "target": f"payload/{group}/test.bin",
+            "sha256": digest,
+            "bytes": 1,
+            "bytes_basis": "measured",
+            "license": "TEST-ONLY"
+        }]
+    groups["containers"] = [{
+        "id": "test-container",
+        "version": "1.0.0-test",
+        "architecture": "amd64",
+        "source": f"invalid.example/test/image@sha256:{digest}",
+        "target": "payload/containers/test.oci",
+        "sha256": digest,
+        "bytes": 1,
+        "bytes_basis": "measured",
+        "license": "TEST-ONLY"
+    }]
+    return {
+        "schema": "nexus-one-ai.offline-workstation-payload-lock.v1",
+        "product": "offline-workstation",
+        "architecture": "amd64",
+        "ubuntu_release": "22.04.5",
+        "approval_record": "CT-G1-2026-009",
+        "status": "reviewed",
+        "unresolved": [],
+        "objects": groups,
+    }
+
+
+class PayloadLockTests(unittest.TestCase):
+    def test_candidate_fails_closed(self) -> None:
+        result = run(CANDIDATE)
+        self.assertEqual(result.returncode, 1)
+        self.assertIn("status must be reviewed", result.stderr)
+        self.assertIn("unresolved must be an empty array", result.stderr)
+
+    def test_complete_test_lock_passes(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            lock = Path(directory) / "payload-lock.json"
+            lock.write_text(json.dumps(complete_lock()), encoding="utf-8")
+            result = run(lock)
+        self.assertEqual(result.returncode, 0, result.stderr)
+
+    def test_mutable_container_and_duplicate_target_fail(self) -> None:
+        data = complete_lock()
+        data["objects"]["containers"][0]["source"] = "invalid.example/test/image:latest"
+        data["objects"]["python"][0]["target"] = data["objects"]["apt"][0]["target"]
+        with tempfile.TemporaryDirectory() as directory:
+            lock = Path(directory) / "payload-lock.json"
+            lock.write_text(json.dumps(data), encoding="utf-8")
+            result = run(lock)
+        self.assertEqual(result.returncode, 1)
+        self.assertIn("must be an OCI reference pinned with @sha256", result.stderr)
+        self.assertIn("duplicate target path", result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()