Harden source release preparation and record verified security follow-up

2026-09-08 08:04:12 +02:00
parent 9554657bb5
commit 58d320d9b3
26 changed files with 3833 additions and 163 deletions
@@ -96,6 +96,18 @@ class PlatformInterfaceInventoryTests(unittest.TestCase):
            with self.assertRaisesRegex(ValueError, "tracking_issue"):
                inventory._load_endpoint_declarations(path)

+    def test_bounded_workflow_read_apis_have_explicit_headless_declarations(self) -> None:
+        declarations = inventory._load_endpoint_declarations(inventory.DEFAULT_ENDPOINT_DECLARATIONS)
+        for path in (
+            "/workflow/instances/summaries", "/workflow/instances/{}/summary",
+            "/workflow/instances/{}/steps", "/workflow/instances/{}/events",
+        ):
+            with self.subTest(path=path):
+                entry = declarations[("govoplan-workflow-engine", "GET", path)]
+                self.assertEqual("intentionally_headless", entry["category"])
+                self.assertIn("current-authorized", entry["rationale"])
+                self.assertIn("workflow.instance-history", entry["rationale"])
+
    def test_inventory_reports_unclassified_and_stale_endpoint_declarations(
        self,
    ) -> None: