From b6efefe52fc6f7d148d4f2137cd08bd7d7dd28f8 Mon Sep 17 00:00:00 2001 From: "pulse-triage[bot]" <249995291+pulse-triage[bot]@users.noreply.github.com> Date: Wed, 7 Oct 2026 15:16:10 +0100 Subject: [PATCH] Bind standalone consent proof only to unattended updates Register the real shell verifier for the updater without admitting it as proof for unrelated installers. Preserve exact installer requirements and test missing/unrelated proof rejection. Change-source: pulse-maintainer --- .../subsystems/deployment-installability.md | 3 ++ .../v6/internal/subsystems/registry.json | 17 +++++- .../canonical_completion_guard_test.py | 52 ++++++++++++++++--- .../release_control/subsystem_lookup_test.py | 7 +-- 4 files changed, 65 insertions(+), 14 deletions(-) diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index e32cd7bb03..fb72048be3 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -38,6 +38,9 @@ against valid and adverse configuration bytes, including padded RC and nested opt-in. `TestAutoUpdateConsentKeepsTimerAndParserBoundaries` checks legacy timer consent, missing parser and nonregular configuration. These are source-level ordinary-user fixtures, not installed timer/systemd or update acceptance. +The registry binds the standalone verifier only to the unattended updater's +runtime policy. It cannot satisfy the archive, PowerShell, Docker or other +installer policies; their existing exact verification obligations remain. ### Server replacement requires admitted bytes and a confirmed inactive service diff --git a/docs/release-control/v6/internal/subsystems/registry.json b/docs/release-control/v6/internal/subsystems/registry.json index a900877aa7..f875485c56 100644 --- a/docs/release-control/v6/internal/subsystems/registry.json +++ b/docs/release-control/v6/internal/subsystems/registry.json @@ -4953,6 +4953,20 @@ "scripts/release_control/ssh_host_key_policy_test.py" ] }, + { + "id": "unattended-update-runtime", + "label": "unattended updater runtime proof", + "match_prefixes": [], + "match_files": [ + "scripts/pulse-auto-update.sh" + ], + "allow_same_subsystem_tests": false, + "test_prefixes": [], + "exact_files": [ + "scripts/installtests/pulse_auto_update_consent_test.go", + "scripts/installtests/pulse_auto_update_test.go" + ] + }, { "id": "deployment-script-runtime", "label": "deployment script runtime proof", @@ -4962,8 +4976,7 @@ "install.sh", "scripts/install-container-agent.sh", "scripts/install-docker.sh", - "scripts/install.ps1", - "scripts/pulse-auto-update.sh" + "scripts/install.ps1" ], "allow_same_subsystem_tests": false, "test_prefixes": [], diff --git a/scripts/release_control/canonical_completion_guard_test.py b/scripts/release_control/canonical_completion_guard_test.py index d76591c18d..c51b713d87 100644 --- a/scripts/release_control/canonical_completion_guard_test.py +++ b/scripts/release_control/canonical_completion_guard_test.py @@ -906,7 +906,7 @@ class CanonicalCompletionGuardTest(unittest.TestCase): ], ) - def test_auto_update_script_change_uses_deployment_script_policy(self): + def test_auto_update_script_change_uses_unattended_update_policy(self): required = infer_impacted_subsystems(["scripts/pulse-auto-update.sh"]) self.assertEqual(set(required), {"deployment-installability"}) @@ -923,22 +923,60 @@ class CanonicalCompletionGuardTest(unittest.TestCase): installability["verification_requirements"], [ { - "id": "deployment-script-runtime", - "label": "deployment script runtime proof", + "id": "unattended-update-runtime", + "label": "unattended updater runtime proof", "touched_runtime_files": ["scripts/pulse-auto-update.sh"], "allow_same_subsystem_tests": False, "test_prefixes": [], "exact_files": [ - "scripts/installtests/install_docker_sh_test.go", - "scripts/installtests/install_ps1_test.go", - "scripts/installtests/install_sh_test.go", + "scripts/installtests/pulse_auto_update_consent_test.go", "scripts/installtests/pulse_auto_update_test.go", - "scripts/installtests/root_install_sh_test.go", ], } ], ) + def test_standalone_consent_proof_is_confined_to_unattended_updater(self): + rule = next( + rule for rule in load_subsystem_rules() + if rule["id"] == "deployment-installability" + ) + proof = "scripts/installtests/pulse_auto_update_consent_test.go" + update_requirement = build_verification_requirements( + rule, ["scripts/pulse-auto-update.sh"] + )[0] + self.assertEqual(update_requirement["id"], "unattended-update-runtime") + self.assertEqual( + staged_verification_files_for_requirement(rule, update_requirement, [proof]), + [proof], + ) + for unmatched in [[], ["scripts/installtests/unrelated_test.go"]]: + with self.subTest(unmatched=unmatched): + self.assertEqual( + staged_verification_files_for_requirement( + rule, update_requirement, unmatched + ), + [], + ) + for runtime in [ + "install.sh", + "scripts/install.ps1", + "scripts/install-docker.sh", + "scripts/install-container-agent.sh", + "docker-compose.yml", + ]: + with self.subTest(runtime=runtime): + requirements = build_verification_requirements(rule, [runtime]) + self.assertTrue(requirements) + for requirement in requirements: + self.assertNotEqual(requirement["id"], "unattended-update-runtime") + self.assertEqual( + staged_verification_files_for_requirement( + rule, requirement, [proof] + ), + [], + ) + def test_vite_config_change_uses_frontend_build_output_policy(self): required = infer_impacted_subsystems(["frontend-modern/vite.config.ts"]) self.assertEqual(set(required), {"deployment-installability"}) diff --git a/scripts/release_control/subsystem_lookup_test.py b/scripts/release_control/subsystem_lookup_test.py index eef0140285..bb4ff2d7b0 100644 --- a/scripts/release_control/subsystem_lookup_test.py +++ b/scripts/release_control/subsystem_lookup_test.py @@ -3722,16 +3722,13 @@ class SubsystemLookupTest(unittest.TestCase): self.assertEqual(match["lane_context"]["lane_id"], "L1") self.assertEqual( match["verification_requirement"]["id"], - "deployment-script-runtime", + "unattended-update-runtime", ) self.assertEqual( match["verification_requirement"]["exact_files"], [ - "scripts/installtests/install_docker_sh_test.go", - "scripts/installtests/install_ps1_test.go", - "scripts/installtests/install_sh_test.go", + "scripts/installtests/pulse_auto_update_consent_test.go", "scripts/installtests/pulse_auto_update_test.go", - "scripts/installtests/root_install_sh_test.go", ], )