docs(handoff): reconcile phase 10 authority and publication baseline

2026-10-29 14:51:30 +01:00
parent 5032ccb415
commit 8804231be4
8 changed files with 1109 additions and 0 deletions
@@ -0,0 +1,65 @@
+"""Bounded read-only Gitea diagnostics; credentials remain in Git's configured helper."""
+import datetime
+import json
+from pathlib import Path
+import socket
+import ssl
+import subprocess
+import urllib.error
+import urllib.request
+
+
+def main():
+    import argparse
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--output', required=True, type=Path)
+    args = parser.parse_args()
+    assert not args.output.exists(), 'Preserve earlier observations'
+    def git(*command):
+        result = subprocess.run(['rtk', 'proxy', 'git', *command], text=True, capture_output=True, timeout=45)
+        return result
+    url = git('remote', 'get-url', 'origin').stdout.strip()
+    assert url == 'https://git.cesnimda.uk/cesnimda/jobtrackingapp.git'
+    record = dict(observedUtc=datetime.datetime.now(datetime.timezone.utc).isoformat(), remote=url,
+                  localCommit=git('rev-parse', 'HEAD').stdout.strip(), tlsVerificationDisabled=False)
+    try:
+        addresses = sorted({item[4][0] for item in socket.getaddrinfo('git.cesnimda.uk', 443, type=socket.SOCK_STREAM)})
+        record['dns'] = dict(status='PASS', addresses=addresses)
+    except OSError as error:
+        record['dns'] = dict(status='BLOCKED', errorType=type(error).__name__)
+    try:
+        with socket.create_connection(('git.cesnimda.uk', 443), timeout=5):
+            record['tcp443'] = dict(status='PASS')
+    except OSError as error:
+        record['tcp443'] = dict(status='BLOCKED', errorType=type(error).__name__)
+    try:
+        with socket.create_connection(('git.cesnimda.uk', 443), timeout=5) as connection:
+            with ssl.create_default_context().wrap_socket(connection, server_hostname='git.cesnimda.uk') as secured:
+                record['tls'] = dict(status='PASS', protocol=secured.version(), certificateVerified=True)
+    except OSError as error:
+        record['tls'] = dict(status='BLOCKED', errorType=type(error).__name__, certificateVerified=False)
+    class NoRedirect(urllib.request.HTTPRedirectHandler):
+        def redirect_request(self, *unused):
+            return None
+    try:
+        with urllib.request.build_opener(NoRedirect()).open('https://git.cesnimda.uk/api/v1/version', timeout=6) as response:
+            record['https'] = dict(status='PASS', httpStatus=response.status)
+    except (OSError, urllib.error.URLError) as error:
+        record['https'] = dict(status='BLOCKED', errorType=type(error).__name__, httpStatus=getattr(error, 'code', None))
+    command = ['ls-remote', '--exit-code', 'origin', 'refs/heads/test/pre-phase10-ux-acceptance', 'refs/heads/planning/int-global-jobs-00']
+    try:
+        result = git(*command)
+        refs = dict(reversed(line.split()) for line in result.stdout.splitlines() if len(line.split()) == 2)
+        record['git'] = dict(argv=['git', *command], exitCode=result.returncode, refs=refs,
+                             authentication='REACHED' if result.returncode == 0 else 'NOT_ESTABLISHED')
+    except subprocess.TimeoutExpired:
+        record['git'] = dict(argv=['git', *command], exitCode=None, refs={}, authentication='NOT_ESTABLISHED', timeoutSeconds=45)
+    record['publication'] = 'VERIFIED' if record['git']['refs'].get('refs/heads/test/pre-phase10-ux-acceptance') == record['localCommit'] else 'BLOCKED'
+    args.output.parent.mkdir(parents=True, exist_ok=True)
+    args.output.write_text(json.dumps(record, indent=2) + '\n', encoding='utf-8')
+    print(json.dumps(record))
+    return 0
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())