Files
minerops/scripts/test-stage-a-security.sh
T
lussierj e898f283ab security: contain physical miner commands in Stage A
Disable physical control through legacy HTTP/M30 producers, typed admission,
queue dispatch and upgraded Windows executors. Restrict diagnostic transports
to exact read-only operations, with ordinal PowerShell validation before sockets.

Retire unsupported pending/claimed work with atomic, idempotent security audits.
Preserve prior delivery evidence and report unknown outcomes after a prior claim,
including explicitly repaired pending rows. Include containment, cancellation,
concurrency and malformed-payload regressions and the old-Agent cutover runbook.

Validation: independent final application-security revalidation PASS. Two unchanged
baseline source-assertion failures are documented as exceptions. Production release
still requires native Windows validation and verified fencing/stop/drain/upgrade;
server cancellation alone cannot revoke a cached command held by an old Agent.
2026-10-15 20:39:45 +00:00

29 lines
1.4 KiB
Bash
Executable File

#!/usr/bin/env bash
# Run inside an isolated test environment with a freshly migrated disposable DB.
# No service creation, cleanup, miner commands, or production defaults.
set -euo pipefail
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "${repo_root}/backend"
[[ "${MINEROPS_STAGE_A_DISPOSABLE:-}" == 1 ]] || {
echo "Require MINEROPS_STAGE_A_DISPOSABLE=1 and an isolated test database." >&2
exit 1
}
export PYTHONDONTWRITEBYTECODE=1
export MINEROPS_ENABLE_REAL_REBOOT=false
export MINEROPS_ENABLE_REAL_POWER_CONTROL=false
python -c 'from app.config import settings; assert settings.postgres_db.startswith("minerops_stage_a_"), "Refusing non-Stage-A database"'
python -m unittest -v \
tests.test_legacy_control_retirement \
tests.test_stage_a_containment \
tests.test_stage_a_containment_postgres \
tests.test_stage_a_delivery_evidence \
tests.test_stage_a_delivery_evidence_postgres \
tests.test_stage_a_schedule_cancellation_postgres \
tests.test_agent_zones_postgres \
tests.test_miner_control \
tests.test_agent_commands.AgentCommandServiceTests \
tests.test_agent_commands.AgentCommandRouterTests
# Separately run agents/windows/tests/Test-MinerOpsControl.ps1 in a network-free
# PowerShell environment, then Test-MinerOpsDiagnosticTransport.ps1. Both load
# functions only. Diagnostic compatibility listeners bind loopback exclusively.