2.5 KiB
Nono evidence harness
Slice 2 provides isolated fixtures, policy execution helpers, redaction, and evidence contracts. It does not install profiles or produce trusted migration evidence from a source checkout.
Test modes
python scripts/test_nono.py
python scripts/test_nono.py --host
The default suite is hermetic. Host mode is mandatory only when explicitly selected and fails rather than skips unless it runs on Linux with Nono 0.74.x. It validates and executes temporary profile paths, proves a minimal profile denies cross-session file access, and proves the deliberately broad fixture exposes its workdir.
Live credential checks are separate:
python scripts/test_nono.py --live --approve-live <approver>
Slice 2 has no credential broker, so this command records a blocked outcome instead of claiming a pass or skip.
Evidence boundary
scripts/nono-evidence.py accepts only fixed test IDs and runs only when the executing producer's repository root is the caller-owned, marker-bearing snapshot whose content matches the supplied SHA-256. A repository checkout cannot identify itself as trusted, and the source producer cannot borrow another snapshot's identity. Slice 3 must install the trusted snapshot and fix its invocation arguments through a maintenance-controlled command policy.
Harness subprocesses receive only explicit isolated environment values: caller-owned mode-0700 HOME, XDG, and temporary directories plus a fixed minimal allowlist of non-credential variables. Output pipes are continuously drained into bounded buffers, and timeouts terminate the subprocess process group.
Raw command material is written under the injected state root as caller-owned mode-0600 files in mode-0700 directories. Summary files follow config/nono/evidence.schema.json and contain hashes and redacted observations, not raw argv, environment, stdout, or stderr. Retention is exactly 30 days: expired evidence is rejected, each trusted producer run purges validated expired entries and recovers interrupted quarantine deletions, and maintenance remains responsible for cleanup when the producer is dormant. Repository commits, policy digests, installed snapshot digests, and Nono versions are verified against the tested checkout, policy file, executing snapshot, and executable rather than accepted as unsupported claims.
The negative and positive matrices are fixture contracts until later slices supply production profiles. They must not be cited as proof that a deferred production capability exists.