Grant Whitmer e6530d3171 test: behavioral G3.5 webhook tests (audit: tests were source-string asserts) ...

Seven HTTP-level tests through the real route: sha256= prefix and bare
digests accepted, digest of re-serialised JSON refused, forged/wrong-key/
missing signatures refused, unset secret -> 503, a revocation with a bad
signature never reaches the handler, the reachability ping never acts.
Mutation-checked: dropping the prefix strip fails the behavioral test
while the old string-grep invariant still passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-23 03:26:14 -04:00

..

__init__.py

G0: cell substrate — invariants made executable

2026-08-11 14:19:28 -04:00

test_ept_and_throttle.py

throttle: stop claiming to limit pushes we cannot see

2026-08-13 23:33:30 -04:00

test_hub_jwt.py

auth: token contract v1 (aud windy_git, both issuers); CI for eternitas

2026-09-23 02:58:56 -04:00

test_invariants.py

auth: token contract v1 (aud windy_git, both issuers); CI for eternitas

2026-09-23 02:58:56 -04:00

test_pr_status_bridge.py

ci: bound CI storage; don't bridge image-build jobs

2026-09-23 02:47:28 -04:00

test_webhooks_behavior.py

test: behavioral G3.5 webhook tests (audit: tests were source-string asserts)

2026-09-23 03:26:14 -04:00