proof-aware-crypto-tooling-.../tests
mrwulf dcb48f453e warden cockpit: local read-only custody UI for the human operator
Operator-ordered milestone, built under an explicit no-risk constraint
while the paper application is in flight: strictly ADDITIVE (one new
module + one CLI subcommand; zero changes to wallet semantics, the
public site, or anything the paper describes), LOCAL-ONLY (never
deployed; binds 127.0.0.1), and READ-ONLY in v1 (human approve/deny is
deliberately deferred — that is a custody-semantics change belonging to
a separately reviewed milestone).

New: src/pacta/walletui.py — four views over an existing wallet:
- Posture: latch state, ledger head with FULL hash-chain
  re-verification, pinned quorum members, spending policy verbatim.
- Signature queue: airgap outbox/inbox, observed never operated.
- Incidents & refusals: verbatim records, newest first.
- Receipt inspector: paste attestation + receipt + log key; verdict,
  per-signature results, and diagnostics come verbatim from
  transparency.verify_receipt — the deployed verifier itself, reused
  not reimplemented.

Design law, stated in the module and enforced by tests: THE COCKPIT
RENDERS EVIDENCE, IT NEVER ASSERTS IT. Every panel recomputes at
request time and carries a provenance line (function + timestamp);
anything unverifiable renders a loud FAILED-TO-VERIFY panel — no cached
green, no neutral gray. Panels state what they do NOT prove (e.g.
binary pinning vs source-to-binary correspondence).

CLI: pacta wallet cockpit --wallet DIR [--host --port].
Tests (10 new, suite 118 -> 128 green): recomputed-evidence rendering,
CHAIN BROKEN on tampered ledger, loud failure on collector error,
latched-state rendering, airgap queue states, verbatim incident/refusal
rendering, fail-closed inspector on garbage, real-evidence roundtrip
(skips if example evidence absent), full-sweep BYTE-LEVEL read-only
guarantee (wallet dir hash-identical after all GETs + a POST), and
fail-fast on non-wallet dirs. Rendering additionally verified visually
against a live demo wallet (posture, quorum table, incidents).

Docs: docs/cockpit.md; WALLET.md section; ESTATE.md + llms.txt updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-19 18:02:17 +02:00
..
fixtures/mini-ed25519-verified/verification initial proof-aware tooling prototype 2026-07-03 10:51:03 +02:00
test_agent.py add policy-gated agent consequences 2026-07-03 11:05:06 +02:00
test_artifact.py add policy-gated agent consequences 2026-07-03 11:05:06 +02:00
test_attestation.py audit v3: paper-reality congruence + external-pointer integrity (Fable-5 Socratic pass) 2026-07-09 21:33:28 +02:00
test_boundaries.py audit v3: paper-reality congruence + external-pointer integrity (Fable-5 Socratic pass) 2026-07-09 21:33:28 +02:00
test_claim_cards.py initial proof-aware tooling prototype 2026-07-03 10:51:03 +02:00
test_claim_failures.py add policy-gated agent consequences 2026-07-03 11:05:06 +02:00
test_curriculum_notebooks.py curriculum: lecture 11 - the customer's-eye view (requirements card, wish-meets-supply, grow-the-supply) 2026-07-07 22:16:05 +02:00
test_doctor.py add verifier bootstrap and attestation lane 2026-07-03 11:24:13 +02:00
test_dogfood.py The provider eats its own dogfood: root signatures via the merkleized library 2026-07-06 15:21:17 +02:00
test_hygiene.py initial proof-aware tooling prototype 2026-07-03 10:51:03 +02:00
test_lean.py fix: fail-closed certificate classification + record-scoped axiom parsing (review round 6) 2026-07-16 15:15:58 +02:00
test_manifest_parsing.py initial proof-aware tooling prototype 2026-07-03 10:51:03 +02:00
test_paper_verifiers.py publish assets: sync the fail-open time bomb; llms/course/test docs refreshed (doc audit 2026-07-19) 2026-07-19 13:10:55 +02:00
test_profiles.py Estate sync: boundary-axiom vocabulary + the four-tier apex reality (R4) 2026-07-06 10:04:43 +02:00
test_provider.py fix: the attestation LEAF now carries its own scope block (review round 6) 2026-07-16 15:25:19 +02:00
test_published_assets.py publish assets: sync the fail-open time bomb; llms/course/test docs refreshed (doc audit 2026-07-19) 2026-07-19 13:10:55 +02:00
test_quorum.py warden re-audit (Fable 5): fix ledger race, quorum perf, small-order honesty 2026-07-07 08:24:51 +02:00
test_risk.py add verifier bootstrap and attestation lane 2026-07-03 11:24:13 +02:00
test_signing.py add nested proof check provider 2026-07-03 13:03:58 +02:00
test_sthstore.py sthstore: equivocation poisons the pin + retains transferable evidence 2026-07-09 17:53:13 +02:00
test_transparency.py add transparency log trust provider 2026-07-03 14:09:34 +02:00
test_wallet.py warden re-audit (Fable 5): fix ledger race, quorum perf, small-order honesty 2026-07-07 08:24:51 +02:00
test_wallet_hardening.py warden hardening round: policy engine, ledger rotation, MCP UX, treasury LIVE, ops docs 2026-07-07 13:38:42 +02:00
test_walletmcp.py warden tests: quorum taxonomy, wallet firewall/ledger/latch, MCP surface (83 passing) 2026-07-06 23:40:35 +02:00
test_walletui.py warden cockpit: local read-only custody UI for the human operator 2026-07-19 18:02:17 +02:00
test_web_and_witness.py publish assets: sync the fail-open time bomb; llms/course/test docs refreshed (doc audit 2026-07-19) 2026-07-19 13:10:55 +02:00