From 0ac35e1e0cdeb8991029154a8cf5de67dfca97c9 Mon Sep 17 00:00:00 2001 From: Coding-Dev-Tools Date: Wed, 22 Jul 2026 03:13:52 -0400 Subject: [PATCH] fix(synthetics): keep rejection alert non-gating --- engraphis/vendor_app.py | 7 ++++++- tests/test_commercial_ga.py | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 1 deletion(-) diff --git a/engraphis/vendor_app.py b/engraphis/vendor_app.py index f4244b5..6f0f307 100644 --- a/engraphis/vendor_app.py +++ b/engraphis/vendor_app.py @@ -128,7 +128,12 @@ def synthetic_trial(request: Request): trial_checks["email_worker"] = _email_worker_ok(app) trial_checks["public_url"] = bool( os.environ.get("ENGRAPHIS_RELAY_PUBLIC_URL", "").strip()) - trial_checks["ready"] = all(trial_checks.values()) + # Keep the public-rejection counter visible to monitoring, but do not make the + # synthetic attacker-controlled. ``vendor_readiness`` applies the same rule: + # invalid lease attempts are an operator alert, not a serving dependency. + trial_checks["ready"] = all( + value for name, value in trial_checks.items() + if name != "rejected_leases") return JSONResponse( trial_checks, status_code=200 if trial_checks["ready"] else 503) diff --git a/tests/test_commercial_ga.py b/tests/test_commercial_ga.py index 22b8ac3..7c56bd7 100644 --- a/tests/test_commercial_ga.py +++ b/tests/test_commercial_ga.py @@ -379,6 +379,41 @@ def test_vendor_readiness_proves_matching_signer_but_honors_release_gate( assert operational["manual_fulfillment"] is True +def test_trial_synthetic_reports_rejected_lease_alert_without_gating(monkeypatch): + from engraphis import vendor_app + from engraphis.config import settings + + monkeypatch.setattr(settings, "service_mode", "vendor") + monkeypatch.setattr(vendor_app, "_admin_ok", lambda _request: True) + monkeypatch.setattr(vendor_app, "_email_worker_ok", lambda _app: True) + monkeypatch.setenv( + "ENGRAPHIS_RELAY_PUBLIC_URL", "https://license.engraphis.test") + checks = { + "signer": True, + "signer_release_ready": True, + "registry": True, + "email": True, + "email_webhook": True, + "email_outbox": True, + "polar_backlog": True, + "rejected_leases": False, + "disk": True, + "backup": True, + "ready": True, + } + monkeypatch.setattr(vendor_app, "vendor_readiness", lambda: checks.copy()) + monkeypatch.setattr( + email_outbox, "process_due", + lambda *_args, **_kwargs: {"processed": 0, "sent": 0, "failed": 0}) + + with TestClient(vendor_app.create_app()) as client: + response = client.get("/ops/synthetic/trial") + + assert response.status_code == 200 + assert response.json()["rejected_leases"] is False + assert response.json()["ready"] is True + + def test_manual_fulfillment_fallback_is_an_authenticated_ops_alert(monkeypatch, tmp_path): from engraphis.inspector import webhooks