fix: require persona stewards for enterprise domains

Human-Authorizer: ICE-GL∞
Persona-Executor: ICE-P-ZY001
Domain-Scope: ENTERPRISE-INFRASTRUCTURE-INTERFACE
Causal-Chain: HLDP://enterprise/domain-steward-interface/2026-07-30
This commit is contained in:
冰朔 2026-07-30 00:45:57 +08:00
commit 7516ef7afc
3 changed files with 87 additions and 6 deletions

View file

@ -70,8 +70,23 @@ with tempfile.TemporaryDirectory() as temp:
assert status["node_id"] == "AW-GZ-001"
assert status["host_state"] == "ONLINE"
assert {domain["state"] for domain in status["domains"] if domain["id"] != "DOMAIN-FIFTH"} == {
"HOSTED_ACTIVE"
"HOSTED_READ_ONLY"
}
assert {
domain["steward_state"] for domain in status["domains"] if domain["id"] != "DOMAIN-FIFTH"
} == {"UNBOUND"}
assert {
domain["mutation_state"] for domain in status["domains"] if domain["id"] != "DOMAIN-FIFTH"
} == {"BLOCKED_UNTIL_PERSONA_STEWARD_BOUND"}
assert all(
domain["human_steward_id"] is None and domain["persona_steward_id"] is None
for domain in status["domains"]
if domain["id"] != "DOMAIN-FIFTH"
)
fifth = next(domain for domain in status["domains"] if domain["id"] == "DOMAIN-FIFTH")
assert fifth["human_steward_id"] == "ICE-GL∞"
assert fifth["persona_steward_id"] == "ICE-P-ZY001"
assert fifth["responsibility_state"] == "EXTERNAL_SOVEREIGN_BOUND"
assert status["node_counts"]["ACTIVE"] == 4
nodes = json.load(urllib.request.urlopen(BASE + "/v1/nodes"))["nodes"]
@ -118,13 +133,13 @@ with tempfile.TemporaryDirectory() as temp:
headers=HEADERS,
)))["state"] == "PENDING_REVIEW"
bootstrap = post("/v1/nodes/bootstrap", {
bootstrap_error = expect_error(423, "/v1/nodes/bootstrap", {
"id": "AW-GZ-001",
"domain_id": "DOMAIN-ZS",
"display_name": "Enterprise root node",
"server_ip": "203.0.113.8",
})
assert bootstrap["state"] == "CONNECTED_PENDING_CONNECTOR"
assert bootstrap_error["required"] == "ACTIVE_HUMAN_BACKED_PERSONA_STEWARD"
preflight = {"action": "health_check", "target_node_id": "AW-GZ-001", "agent_id": "AW-INSPECTOR"}
expect_error(423, "/v1/preflight", preflight)
@ -134,7 +149,7 @@ with tempfile.TemporaryDirectory() as temp:
"target_node_id": "AW-GZ-001",
})
preflight["unlock_id"] = unlocked["unlock_id"]
assert post("/v1/preflight", preflight)["decision"] == "REJECT"
expect_error(404, "/v1/preflight", preflight)
assert post("/v1/agents/consume", {
**preflight,
"unlock_id": unlocked["unlock_id"],