feat: implement T-019 reliable event ingress

tests/test_brain_event_ingress_contract.py

@@ -0,0 +1,70 @@
+"""Cross-language invariants for Brain-to-Bell event ingress v1."""
+
+from __future__ import annotations
+
+import json
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+CONTRACT = ROOT / "docs" / "contracts" / "brain-event-ingress-v1.openapi.json"
+EVENT_SCHEMA = ROOT / "docs" / "raw" / "contracts" / "event-v0.1.schema.json"
+
+
+class BrainEventIngressContractTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.document = json.loads(CONTRACT.read_text(encoding="utf-8"))
+        cls.event_schema = json.loads(EVENT_SCHEMA.read_text(encoding="utf-8"))
+
+    def test_candidate_is_exact_final_top_level_shape_minus_bell_id(self) -> None:
+        candidate = self.document["components"]["schemas"]["EventV01Candidate"]
+        expected = set(self.event_schema["required"]) - {"id"}
+        self.assertEqual(expected, set(candidate["required"]))
+        self.assertEqual(expected, set(candidate["properties"]))
+        self.assertFalse(candidate["additionalProperties"])
+        self.assertIn("id", self.event_schema["required"])
+
+    def test_transport_auth_and_statuses_are_frozen(self) -> None:
+        operation = self.document["paths"]["/internal/v1/event-candidates"]["post"]
+        self.assertEqual({"200", "201", "400", "401", "403", "409", "413", "422", "503"}, set(operation["responses"]))
+        header_names = {
+            self.document["components"]["parameters"][parameter["$ref"].split("/")[-1]]["name"]
+            for parameter in operation["parameters"]
+        }
+        self.assertEqual(
+            {"X-YoVision-Key-Id", "X-YoVision-Timestamp", "X-YoVision-Nonce", "X-YoVision-Signature"},
+            header_names,
+        )
+
+    def test_numeric_safety_bounds_match_both_implementations(self) -> None:
+        signature = self.document["x-yovision-signature"]
+        delivery = self.document["x-yovision-delivery"]
+        self.assertEqual((300, 600, 32), (signature["clock_skew_seconds"], signature["nonce_receipt_ttl_seconds"], signature["minimum_secret_bytes"]))
+        self.assertEqual((1048576, 10, 1, 300, 100, 10000), (
+            delivery["maximum_body_bytes"], delivery["deadline_seconds"], delivery["initial_retry_seconds"],
+            delivery["maximum_retry_seconds"], delivery["maximum_attempts"], delivery["maximum_queued"],
+        ))
+        brain = (ROOT / "Brain" / "yovision_brain" / "ingress.py").read_text(encoding="utf-8")
+        bell = (ROOT / "Bell" / "internal" / "ingress" / "ingress.go").read_text(encoding="utf-8")
+        for marker in (
+            "/internal/v1/event-candidates", "X-YoVision-Key-Id", "X-YoVision-Timestamp",
+            "X-YoVision-Nonce", "X-YoVision-Signature",
+        ):
+            self.assertIn(marker, brain)
+            self.assertIn(marker, bell)
+        self.assertIn("MAX_QUEUED = 10_000", brain)
+        self.assertIn("MAX_ATTEMPTS = 100", brain)
+        self.assertIn("300*time.Second", bell)
+
+    def test_event_key_is_bound_to_producer_and_separate_from_audit(self) -> None:
+        key_shape = self.document["x-yovision-signature"]["key_document_shape"]["keys"][0]
+        self.assertEqual({"key_id", "producer_id", "secret_base64url"}, set(key_shape))
+        bell_main = (ROOT / "Bell" / "cmd" / "bell-api" / "main.go").read_text(encoding="utf-8")
+        self.assertIn("BELL_EVENT_INGRESS_KEYS_FILE", bell_main)
+        self.assertIn("BELL_AUDIT_KEYS_FILE", bell_main)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_postgres_contract.py

@@ -62,6 +62,8 @@ class PostgresContractTests(unittest.TestCase):
                 "013_privileges_bell_events.sql",
                 "014_audit_relay.sql",
                 "015_privileges_audit_relay.sql",
+                "016_event_ingress.sql",
+                "017_privileges_event_ingress.sql",
             ],
             names,
         )
@@ -146,6 +148,28 @@ class PostgresContractTests(unittest.TestCase):
         self.assertIn("grant select, insert on table bell.audit_events to bell_runtime", privileges)
         self.assertIn("revoke all on table bell.audit_events, bell.audit_relay_receipts from sense_app", privileges)
 
+    def test_event_ingress_has_permanent_source_receipts_and_minimal_privileges(self) -> None:
+        migration = normalized(migration_text("016_event_ingress.sql"))
+        privileges = normalized(migration_text("017_privileges_event_ingress.sql"))
+        for marker in (
+            "create table if not exists bell.event_ingress_bindings",
+            "create table if not exists bell.event_ingress_receipts",
+            "primary key (producer_id, source_event_id)",
+            "create table if not exists bell.event_ingress_nonces",
+            "expires_at >= received_at + interval '10 minutes'",
+            "insert into bell.schema_migrations(version) values (5)",
+        ):
+            self.assertIn(marker, migration)
+        self.assertIn(
+            "grant select, insert on table bell.event_ingress_receipts to bell_runtime",
+            privileges,
+        )
+        self.assertIn(
+            "grant select, insert, delete on table bell.event_ingress_nonces to bell_runtime",
+            privileges,
+        )
+        self.assertNotIn("endpoint_ref", privileges.split("revoke all on table sense.devices")[1])
+
 
 if __name__ == "__main__":
     unittest.main()