cc-ci

Files

autonomic-bot 9e88741864 feat(2): Q2.4 acceptance — lasuite-docs + keycloak dep + OIDC password grant (cold green)

- tests/lasuite-docs/recipe_meta.py: DEPS = ['keycloak'] declares the SSO provider dep.
  Orchestrator deploys a per-run keycloak BEFORE lasuite-docs (Q2.3 dep resolver) and tears it
  down AFTER in finally.
- tests/lasuite-docs/functional/test_oidc_with_keycloak.py: Q2 gate acceptance test.
  - Asserts deps_apps['keycloak'] is the per-run dep domain.
  - Calls harness.sso.setup_keycloak_realm to create realm/client/test-user idempotently.
  - GET /.well-known/openid-configuration; asserts issuer = https://<kc>/realms/lasuite-docs.
  - harness.sso.oidc_password_grant: password-grant flow; asserts the JWT iss/azp/typ/exp.
  - Non-vacuous: each step uses real per-run-generated creds (class-B per §4.4-B), would fail
    on broken admin API / token endpoint / wrong claims.

Cold-verifiable on cc-ci (log /root/ccci-q24-lasuite-keycloak.log):
  RECIPE=lasuite-docs STAGES=install,custom cc-ci-run runner/run_recipe_ci.py
  ===== DEPS: ['keycloak'] =====
    dep: deploying keycloak -> keyc-c12afe.ci.commoninternet.net
    dep: keycloak ready @ keyc-c12afe.ci.commoninternet.net
  ===== TIER: install =====   2 PASS (generic + cc-ci overlay)
  ===== TIER: custom =====    1 PASS (test_oidc_password_grant_against_dep_keycloak)
  ===== DEPS teardown =====
  ===== RUN SUMMARY =====
  deploy-count = 2 (expect 2)   # 1 parent + 1 dep

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-28 08:08:11 +01:00

functional

feat(2): Q2.4 acceptance — lasuite-docs + keycloak dep + OIDC password grant (cold green)

2026-05-28 08:08:11 +01:00

ops.py

feat(1e): HC3 additive generic + op/assertion split (orchestrator owns the op)

2026-05-28 03:12:04 +01:00

recipe_meta.py

feat(2): Q2.4 acceptance — lasuite-docs + keycloak dep + OIDC password grant (cold green)

2026-05-28 08:08:11 +01:00

test_backup.py

feat(1e): HC3 additive generic + op/assertion split (orchestrator owns the op)