ms2k/nuthatch
SHA256
Watch
0
Code Releases Activity

Split kind tests into component-owned probes

Browse source
This commit is contained in:
ms2k 2026-07-19 23:57:21 +09:00
commit 691ad92e30
1 changed files with 4269 additions and 3108 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/spec/contracts.md
View file

@ -179,10 +179,9 @@ authority over other buckets. End users and browsers never receive its
credentials.
The deployment's object-store IAM or policy system enforces that scope. The
Kubernetes manifest supplies the scoped credential through the secret boundary;
`tests/kind/lib.sh` provisions equivalent fixture principals, and
`tests/kind/product-matrix-job.yaml.in` verifies denial against a different
bucket.
Kubernetes manifest supplies the scoped credential through the secret boundary.
`tests/kind/fixture/target.sh` provisions equivalent fixture principals, and
`test/AuthProbe.hs` verifies denial against a different bucket.
Nuthatch is the exclusive writer to `users/` and `shared/` in the configured
bucket while the service is enabled. Operators may inspect those prefixes, but